CVE-2026-45799: 
Java vulnerability analysis and mitigation

CVE-2026-45799 is a denial-of-service vulnerability in Square's Wire protobuf library, titled "skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service." The flaw affects com.squareup.wire:wire-runtime versions ≤ 6.2.0 and alpha versions 7.0.0-alpha01 through 7.0.0-alpha02, as well as the discontinued com.squareup.wire:wire-runtime-jvm artifact through version 5.3.3. It was reported by @TrekLaps, fixed on May 12–13, 2026, and publicly disclosed on May 14, 2026 via a GitHub Security Advisory. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) (GitHub Advisory, Wire Advisory).

The root cause is classified as CWE-129 (Improper Validation of Array Index). ByteArrayProtoReader32.skipGroup() in Wire's wire-runtime read a LENGTH_DELIMITED field's length as a signed Int via internalReadVarint32() without validating that the value was non-negative before passing it to skip(). A crafted varint encoding -128 causes skip(-128) to underflow the internal position counter (e.g., pos = 7 + (-128) = -121), which passes the newPos > limit guard and sets pos to an invalid negative value. The subsequent readByte() call then attempts to access source[-121], throwing an ArrayIndexOutOfBoundsException — an unchecked RuntimeException that escapes Wire's documented IOException/ProtocolException error boundary and can crash the calling request handler. Critically, skipGroup() is invoked for any unknown field with wire type 3 (START_GROUP), meaning no schema knowledge is required to exploit any Wire-decoding service (Wire Advisory, Fix PR #3595).

Successful exploitation causes an unhandled ArrayIndexOutOfBoundsException that crashes the request handler of any service decoding untrusted protobuf payloads with Wire. The impact is limited to availability — there is no confidentiality or integrity compromise. Because the exploit payload is only 10 bytes and requires no authentication, privileges, or user interaction, a remote attacker can trivially and repeatedly crash targeted services, resulting in sustained denial of service (GitHub Advisory, Wire Advisory).

1. Identify target: Locate a service that accepts protobuf-encoded input and uses the Wire library (com.squareup.wire:wire-runtime ≤ 6.2.0 or wire-runtime-jvm ≤ 5.3.3) for decoding.
2. Craft the payload: Construct the 10-byte malicious protobuf payload: 0x9B 0x06 0x0A 0x80 0xFF 0xFF 0xFF 0x0F 0x9C 0x06 (hex: 9b060a80ffffff0f9c06). This encodes field 99 as START_GROUP, field 1 as LENGTH_DELIMITED with a varint value of -128, followed by the END_GROUP tag.
3. Send the payload: Transmit the crafted payload to any endpoint that triggers Wire's ProtoAdapter.decode() — no knowledge of the target's protobuf schema is required, as the malicious field is an unknown field that triggers the generic skipGroup() code path.
4. Trigger the crash: Wire's ByteArrayProtoReader32.skipGroup() reads the -128 length, underflows the internal position counter to -121, and the subsequent readByte() throws ArrayIndexOutOfBoundsException, crashing the request handler.
5. Repeat for sustained DoS: Because the payload is trivially small and requires no state, the attacker can send it repeatedly to maintain a denial-of-service condition (Wire Advisory, GitHub Advisory).

• Network: Repeated inbound requests containing the 10-byte hex payload 9b060a80ffffff0f9c06 in the request body; unusual volume of short protobuf-encoded requests to protobuf-consuming endpoints.
• Logs: Unhandled java.lang.ArrayIndexOutOfBoundsException stack traces originating from com.squareup.wire.ByteArrayProtoReader32.readByte or skipGroup in application logs; repeated request handler crashes or 500-level errors correlated with specific source IPs.
• Process: JVM process restarts or crash dumps associated with Wire decoding threads; thread dumps showing ArrayIndexOutOfBoundsException at ByteArrayProtoReader32.kt:448 (Wire Advisory).

The primary remediation is to upgrade com.squareup.wire:wire-runtime to version 6.3.0 or later, which adds a negative-length check in skipGroup() and throws ProtocolException instead of allowing the invalid state. For Wire 7 alpha users, upgrade to 7.0.0-alpha03 or later, or build from a commit containing the fix (merged May 12, 2026). Users of the discontinued com.squareup.wire:wire-runtime-jvm artifact (≤ 5.3.3) will not receive a patch and must migrate to com.squareup.wire:wire-runtime:6.3.0 or later. As a temporary workaround where upgrading is not immediately possible, avoid exposing Wire-decoding endpoints to untrusted input (GitHub Advisory, Fix PR #3595, Fix PR #3597).

The vulnerability was reported by community researcher @TrekLaps and addressed promptly by the Wire maintainers, with fixes merged within two days of the internal report and the advisory published on May 14, 2026. The fix was reviewed and approved by notable Wire contributors including JakeWharton. No significant broader media coverage or social media discussion has been identified beyond the official advisory (Wire Advisory, Fix PR #3595).