CVE-2026-45799

Name of the Vulnerable Software and Affected Versions wire-runtime versions prior to 6.3.0 wire-runtime-jvm versions 5.3.1 and 5.3.3 Wire 7 alpha versions prior to 7.0.0-alpha03

Description In the wire-runtime component, the ByteArrayProtoReader32.skipGroup() and ProtoReader.skipGroup() functions fail to validate that a LENGTH DELIMITED field length is non-negative before calling the skip() function. An attacker can provide a crafted protobuf varint encoding -128 as a signed Int, causing the internal position counter to underflow to a negative value. Consequently, the subsequent call to readByte() accesses the source at an invalid negative position, triggering an ArrayIndexOutOfBoundsException. Because ProtoAdapter.decode(byte[]) is documented to throw IOException, this unchecked runtime exception can bypass error handling and crash services that decode untrusted protobuf payloads.

Recommendations Update wire-runtime to version 6.3.0 or later. Migrate wire-runtime-jvm to wire-runtime version 6.3.0 or later. Update Wire 7 alpha to version 7.0.0-alpha03 or later.