CyberRota Analysis
AI-GeneratedThe vulnerability affects the Wire library's gRPC and protocol buffers implementations for Android and Java, specifically in the ByteArrayProtoReader32 and ProtoReader classes, where improper validation of LENGTH_DELIMITED field lengths can lead to negative internal position shifts. This flaw can cause services using ProtoAdapter.decode(byte[]) to crash when processing untrusted payloads, resulting in potential denial-of-service scenarios. Developers and organizations utilizing affected versions prior to 6.3.0 and 7.0.0-alpha03 should prioritize updating to mitigate this high-severity risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Wire provides gRPC and protocol buffers for Android, Kotlin, Swift, and Java. Prior to 6.3.0 and 7.0.0-alpha03, ByteArrayProtoReader32.skipGroup() and ProtoReader.skipGroup() in wire-runtime do not validate that a LENGTH_DELIMITED field length is non-negative before skip(), allowing a crafted protobuf varint encoding -128 as a signed Int to make skip(-128) move the internal position negative and make the next readByte() throw ArrayIndexOutOfBoundsException instead of the documented IOException or ProtocolException, which can crash services using ProtoAdapter.decode(byte[]) on untrusted payloads. This issue is fixed in versions 6.3.0 and 7.0.0-alpha03.
Related CVEs
Other vulnerabilities affecting the same vendor(s)