CVE-2024-58103: 
Java vulnerability analysis and mitigation

Square Wire before version 5.2.0 contains a vulnerability related to nested groups in ByteArrayProtoReader32.kt and ProtoReader.kt components, where the software does not enforce a recursion limit. This vulnerability was assigned CVE-2024-58103 and was disclosed on March 16, 2025 (NVD).

The vulnerability stems from the lack of recursion limit enforcement when processing nested groups in two key components: ByteArrayProtoReader32.kt and ProtoReader.kt. The issue has been assigned a CVSS v3.1 base score of 5.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L. The vulnerability is classified as CWE-674 (Uncontrolled Recursion) (NVD).

When exploited, this vulnerability could lead to uncontrolled recursion, potentially causing system resource exhaustion and denial of service conditions. The lack of recursion limits in nested group processing could allow attackers to create maliciously crafted inputs that trigger excessive recursive operations (NVD).

The vulnerability has been fixed in Square Wire version 5.2.0. The fix implements a recursion limit check for nested groups in both ByteArrayProtoReader32.kt and ProtoReader.kt. Users should upgrade to version 5.2.0 or later to receive the security fix (Wire Release).