https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T09:32:13.301060+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/fkie_cve-2026-61695 fkie_cve-2026-61695 2026-09-29T09:32:13.333108+00:00

Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.4.1 and 7.0.0-alpha04, Wire's Swift runtime ProtoReader.skipGroup(expectedEndTag:unknownFieldsWriter:) accepts a negative length for a LENGTH_DELIMITED field inside an unknown START_GROUP field. ProtoReader.readData() forwards the negative count to ReadBuffer.readData(count:), whose upper-bound-only check permits the value to reach Foundation Data(bytes:count:) and trigger an unrecoverable process trap instead of a catchable ProtoDecoder.Error. Any Swift process decoding untrusted protobuf bytes can be crashed without authentication, user interaction, or knowledge of the target schema. This issue is fixed in versions 6.4.1 and 7.0.0-alpha04.

 https://vulnerability.circl.lu/vuln/ghsa-86wm-r4c5-2rc9 GHSA-86wm-r4c5-2rc9 — Wire Swift runtime: negative LENGTH_DELIMITED length in skipGroup() crashes any protobuf-decoding service 2026-09-29T09:32:13.333191+00:00

Affected: SwiftURL: github.com/square/wire

### Summary

Wire's Swift runtime (`Wire` SPM/CocoaPods product, implemented by `wire-runtime-swift`) did not reject a negative `LENGTH_DELIMITED` field length while skipping an unknown protobuf group. A crafted 10-byte protobuf payload could cause `ProtoReader.skipGroup()` to read a length-delimited field whose varint decodes to a negative `Int32`. That negative value was then passed to `ReadBuffer.readData(count:)`.

`ReadBuffer` checked only that the requested read did not go past the end of the buffer. It did not reject negative counts. As a result, a negative count could pass the bounds check and reach Foundation's `Data(bytes:count:)`, which traps and aborts the process (`Signal 5` / SIGTRAP) instead of throwing Wire's documented `ProtoDecoder.Error`.

This is the Swift sibling of the Kotlin/JVM negative-length-in-`skipGroup()` issue fixed in `com.squareup.wire:wire-runtime` 6.3.0 (`CVE-2026-45799`, `GHSA-7xpr-hc2w-34m9`). That earlier fix added a `length < 0` rejection to the Kotlin readers. The functionally similar Swift `ProtoReader.skipGroup()` path was not covered by that fix and remained vulnerable in released Swift runtime versions through `6.4.0`, and in Wire 7 alpha releases through `7.0.0-alpha03`.

The issue is fixed for the supported 6.x release line in Wire `6.4.1`.

`skipGroup()` runs for any unknown field with wire type 3 (`START_GROUP`), so no schema knowledge is required. A service decoding any message type with `ProtoDecoder.decode(_:from:)` over untr…