CVE-2026-61695

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-61695
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-61695.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-61695
Aliases
Published
2026-09-23T18:44:11Z
Modified
2026-09-24T03:46:08Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding service
Details

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.1 and 7.0.0-alpha04, Wire's Swift runtime ProtoReader.skipGroup(expectedEndTag:unknownFieldsWriter:) accepts a negative length for a LENGTH_DELIMITED field inside an unknown START_GROUP field. ProtoReader.readData() forwards the negative count to ReadBuffer.readData(count:), whose upper-bound-only check permits the value to reach Foundation Data(bytes:count:) and trigger an unrecoverable process trap instead of a catchable ProtoDecoder.Error. Any Swift process decoding untrusted protobuf bytes can be crashed without authentication, user interaction, or knowledge of the target schema. This issue is fixed in versions 6.4.1 and 7.0.0-alpha04.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-129"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/61xxx/CVE-2026-61695.json"
}
References

Affected packages

Git / github.com/square/wire

Affected ranges

Type
GIT
Repo
https://github.com/square/wire
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ab7d1fb266da480dfdd8445deaa5e4c7cb39106c
Introduced
5df07027c6b180d9a807f5b8afda13760c7a114b
Fixed
94f6bb7964d2ad5c691ce325f85f1a7556eb247b
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "6.4.1"
        },
        {
            "introduced":  "7.0.0-alpha01"
        },
        {
            "fixed":  "7.0.0-alpha04"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

3.*
3.0.0
3.0.0-alpha01
3.0.0-alpha02
3.0.0-alpha03
3.0.0-rc01
3.0.0-rc02
3.0.0-rc03
3.0.2
3.0.3
3.3.0
3.3.0-alpha1
3.3.0-alpha2
3.4.0
3.5.0
3.5.1-alpha1
3.5.1-alpha2
3.6.0
3.6.0-alpha1
3.6.1
3.6.1-alpha1
3.7.0
3.8.0-alpha1
4.*
4.0.0
4.0.0-alpha.10
4.0.0-alpha.11
4.0.0-alpha.15
4.0.0-alpha.16
4.0.0-alpha.17
4.0.0-alpha.18
4.0.0-alpha.2
4.0.0-alpha.20
4.0.0-alpha.3
4.0.0-alpha.4
4.0.0-alpha.5
4.0.0-alpha.6
4.0.0-alpha.7
4.0.0-alpha.8
4.0.0-alpha.9
4.0.0-alpha1
4.0.0-alpha12
4.0.0-alpha13
4.0.1
4.1.0
4.1.1
4.2.0
4.3.0
4.4.0
4.4.1
4.4.2
4.4.3
4.5.0
4.5.1
4.5.2
4.5.3
4.5.4
4.5.5
4.5.6
4.6.0
4.6.1
4.6.2
4.7.0
4.7.1
4.7.2
4.8.0
4.8.1
4.9.0
4.9.1
4.9.1-square01
4.9.2
4.9.2-square02
4.9.2-square03
4.9.2-square04
4.9.3
4.9.3-square01
4.9.4
4.9.4-square01
4.9.4-square02
4.9.5
4.9.6
5.*
5.0.0
5.0.0-alpha.square.6
5.0.0-alpha.square.7
5.0.0-alpha.square.8
5.0.0-alpha.square.9
5.0.0-alpha01
5.0.0-alpha02
5.0.0-alpha02-square01
5.0.0-alpha02-square02
5.0.0-alpha03
5.0.0-alpha04
5.1.0
5.1.1-alpha.20240917.084212.96bbc3907
5.1.1-alpha.20240920.094122.b98afbb7d.1304
5.1.1-alpha.20241004.194750.5a2084117
5.1.1-alpha.20241016.095539.16b796241
5.1.1-alpha.20241017.175147.633cf04b4
5.1.1-alpha.20241127.134142.06e7597bb.v2
5.1.1-alpha.20241206.191847.01e8f3013
5.2.0
5.2.1
5.3.0
5.3.0-alpha.20250123.214551.e8d52ce62
5.3.0-alpha.20250212.164711.8dddcef3d
5.3.0-alpha.20250212.164711.8dddcef3d.v2
5.3.1
5.3.10
5.3.11
5.3.2
5.3.3
5.3.4
5.3.5
5.3.6
5.3.7
5.3.8
5.4.0
5.4.0-alpha.20250326.102750.35956c85e
5.4.0-alpha.20250429.015041.560b597d7
5.4.0-alpha.20250516.195227.10d8b20b2
5.4.0-alpha.20250801.192044.864c6c36c
5.4.1-alpha.20250925.224059.6ad9f5738
6.*
6.0.0
6.0.0-alpha01
6.0.0-alpha02
6.0.0-alpha03
6.1.0
6.2.0
6.3.0
6.4.0
7.*
7.0.0-alpha01
7.0.0-alpha02
7.0.0-alpha03
parent-3.*
parent-3.0.0-rc02
parent-3.0.1
parent-3.1.0
parent-3.2.0
parent-3.2.1
parent-3.2.2
parent-4.*
parent-4.0.0-alpha.12
parent-4.0.0-alpha.13
parent-4.0.0-alpha.14
parent-4.0.0-alpha.15
parent-4.0.0-alpha13
wire-1.*
wire-1.0.0
wire-1.0.1
wire-1.1.0
wire-1.1.1
wire-1.2.0
wire-1.3.0
wire-1.3.1
wire-1.3.2
wire-1.3.3
wire-1.4.0
wire-1.5.0
wire-1.5.1
wire-1.5.2
wire-1.6.0
wire-1.6.1
wire-1.7.0
wire-1.8.0
wire-2.*
wire-2.0.0
wire-2.0.0-BETA1
wire-2.0.0-BETA10
wire-2.0.0-BETA2
wire-2.0.0-BETA3
wire-2.0.0-BETA4
wire-2.0.0-BETA5
wire-2.0.0-BETA6
wire-2.0.0-BETA7
wire-2.0.0-BETA8
wire-2.0.0-BETA9
wire-2.0.1
wire-2.0.2
wire-2.0.3
wire-2.1.0
wire-2.1.1
wire-2.1.2
wire-2.2.0
wire-2.3.0-RC1
wire-3.*
wire-3.0.1

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-61695.json"