{"action":"Upgrade com.squareup.wire:wire-runtime-jvm to 6.3.0 (6.x) or 7.0.0-alpha03 (7.x) or later.","affected":[{"fixed":"6.3.0","introduced":"0"},{"fixed":"7.0.0-alpha03","introduced":"7.0.0-alpha01"}],"component":"com.squareup.wire:wire-runtime-jvm","cve_ids":["CVE-2026-45799"],"ecosystem":"Maven","epss":0.00728,"exploited":false,"fixed_versions":["6.3.0","7.0.0-alpha03"],"ghsa_id":"GHSA-7xpr-hc2w-34m9","id":"tcs_01M5N8KE67RTP36R4FX54KDYTE","modified_at":"2026-08-05T15:00:21.927555867Z","published_at":"2026-05-19T19:54:50Z","references":["https://osv.dev/vulnerability/GHSA-7xpr-hc2w-34m9","https://github.com/square/wire/security/advisories/GHSA-7xpr-hc2w-34m9","https://nvd.nist.gov/vuln/detail/CVE-2026-45799","https://github.com/square/wire/pull/3595","https://github.com/square/wire/pull/3597","https://github.com/square/wire/commit/47d5b0dba53935d5332cd41a80a353b3fc90e7b0","https://github.com/square/wire/commit/e4e56fab38a547d9625f05c97f1d8f0bcc3a5773","https://github.com/square/wire","https://github.com/square/wire/releases/tag/6.3.0","https://github.com/square/wire/releases/tag/7.0.0-alpha03"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-7xpr-hc2w-34m9","url":"https://osv.dev/vulnerability/GHSA-7xpr-hc2w-34m9"}],"summary":"Wire: skipGroup() missing negative-length check allows 10-byte payload to crash any Wire-decoding service"}