CVE-2026-63126

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-63126
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63126.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-63126
Aliases
Published
2026-09-16T18:13:33Z
Modified
2026-09-18T03:48:30Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Wire: Unauthenticated decoder crash via 32-bit length integer overflow in ByteArrayProtoReader32 (incomplete fix of CVE-2026-45799)
Details

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.5 and 7.0.0-alpha04, Wire protobuf readers do not consistently validate attacker-controlled lengths against the current logical message boundary before advancing cursors, pointers, limits, slices, or allocations. In Kotlin, ProtoAdapter.decode(ByteArray) and ProtoAdapter.decode(ByteString) use ByteArrayProtoReader32.internalNextLengthDelimited(), where a positive oversized length can wrap pos + length to a negative limit and escape the existing negative-length check. Related ProtoReader, ReadBuffer.readVarint(), ReadBuffer.verifyAdditional(count:), packed-repeated, nested-message, and ProtoDecoder.decodeSizeDelimited(_:from:) paths can cross logical boundaries, perform pointer arithmetic, reserve capacity, or convert an unrepresentable size before proving the requested bytes exist. An attacker who supplies malformed protobuf bytes can cause unchecked exceptions, traps, out-of-bounds behavior, or excessive allocation, resulting in denial of service without known confidentiality, integrity, or code-execution impact. This issue is fixed in versions 6.4.5 and 7.0.0-alpha04.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-190"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/63xxx/CVE-2026-63126.json"
}
References

Affected packages

Git / github.com/square/wire

Affected ranges

Type
GIT
Repo
https://github.com/square/wire
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Introduced
5df07027c6b180d9a807f5b8afda13760c7a114b
Fixed
efbbc2904d07cf8202d49a9eef502d09b17c88d6
Fixed
94f6bb7964d2ad5c691ce325f85f1a7556eb247b
Fixed
082d5d83cec57ef68f1dd7d3e3d1d641c1fb670f
Fixed
25ebcabb9ab7f12d1d77af75ecbc51726fddc015
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "6.4.5"
        },
        {
            "introduced": "7.0.0-alpha01"
        },
        {
            "fixed": "7.0.0-alpha04"
        }
    ],
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

3.*
3.0.0
3.0.0-alpha01
3.0.0-alpha02
3.0.0-alpha03
3.0.0-rc01
3.0.0-rc02
3.0.0-rc03
3.0.2
3.0.3
3.3.0
3.3.0-alpha1
3.3.0-alpha2
3.4.0
3.5.0
3.5.1-alpha1
3.5.1-alpha2
3.6.0
3.6.0-alpha1
3.6.1
3.6.1-alpha1
3.7.0
3.8.0-alpha1
4.*
4.0.0
4.0.0-alpha.10
4.0.0-alpha.11
4.0.0-alpha.15
4.0.0-alpha.16
4.0.0-alpha.17
4.0.0-alpha.18
4.0.0-alpha.2
4.0.0-alpha.20
4.0.0-alpha.3
4.0.0-alpha.4
4.0.0-alpha.5
4.0.0-alpha.6
4.0.0-alpha.7
4.0.0-alpha.8
4.0.0-alpha.9
4.0.0-alpha1
4.0.0-alpha12
4.0.0-alpha13
4.0.1
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.6.0
4.6.1
4.6.2
4.7.0
4.7.1
4.7.2
4.8.0
4.8.1
4.9.0
4.9.1
4.9.1-square01
4.9.2
4.9.2-square02
4.9.2-square03
4.9.2-square04
4.9.3
4.9.3-square01
4.9.4
4.9.4-square01
4.9.4-square02
4.9.5
4.9.6
5.*
5.0.0
5.0.0-alpha.square.6
5.0.0-alpha.square.7
5.0.0-alpha.square.8
5.0.0-alpha.square.9
5.0.0-alpha01
5.0.0-alpha02
5.0.0-alpha02-square01
5.0.0-alpha02-square02
5.0.0-alpha03
5.0.0-alpha04
5.1.0
5.1.1-alpha.20240917.084212.96bbc3907
5.1.1-alpha.20240920.094122.b98afbb7d.1304
5.1.1-alpha.20241004.194750.5a2084117
5.1.1-alpha.20241016.095539.16b796241
5.1.1-alpha.20241017.175147.633cf04b4
5.1.1-alpha.20241127.134142.06e7597bb.v2
5.1.1-alpha.20241206.191847.01e8f3013
5.2.0
5.2.1
5.3.0
5.3.0-alpha.20250123.214551.e8d52ce62
5.3.0-alpha.20250212.164711.8dddcef3d
5.3.0-alpha.20250212.164711.8dddcef3d.v2
5.3.1
5.3.10
5.3.11
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.4.0
5.4.0-alpha.20250326.102750.35956c85e
5.4.0-alpha.20250429.015041.560b597d7
5.4.0-alpha.20250516.195227.10d8b20b2
5.4.0-alpha.20250801.192044.864c6c36c
5.4.1-alpha.20250925.224059.6ad9f5738
6.*
6.0.0
6.0.0-alpha01
6.0.0-alpha02
6.0.0-alpha03
6.1.0
6.2.0
6.3.0
6.4.0
6.4.1
7.*
7.0.0-alpha01
7.0.0-alpha02
7.0.0-alpha03
parent-3.*
parent-3.0.0-rc02
parent-3.0.1
parent-3.1.0
parent-3.2.0
parent-3.2.1
parent-3.2.2
parent-4.*
parent-4.0.0-alpha.12
parent-4.0.0-alpha.13
parent-4.0.0-alpha.14
parent-4.0.0-alpha.15
parent-4.0.0-alpha13
wire-1.*
wire-1.0.0
wire-1.0.1
wire-1.1.0
wire-1.1.1
wire-1.2.0
wire-1.3.0
wire-1.3.1
wire-1.3.2
wire-1.3.3
wire-1.4.0
wire-1.5.0
wire-1.5.1
wire-1.5.2
wire-1.6.0
wire-1.6.1
wire-1.7.0
wire-1.8.0
wire-2.*
wire-2.0.0
wire-2.0.0-BETA1
wire-2.0.0-BETA10
wire-2.0.0-BETA2
wire-2.0.0-BETA3
wire-2.0.0-BETA4
wire-2.0.0-BETA5
wire-2.0.0-BETA6
wire-2.0.0-BETA7
wire-2.0.0-BETA8
wire-2.0.0-BETA9
wire-2.0.1
wire-2.0.2
wire-2.0.3
wire-2.1.0
wire-2.1.1
wire-2.1.2
wire-2.2.0
wire-2.3.0-RC1
wire-3.*
wire-3.0.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-63126.json"