VDB
Sign up
MEDIUM5.8

GHSA-pwf9-q62p-v7wc

Wire has Uncontrolled Recursion on Nested Groups

Quick fix

GHSA-pwf9-q62p-v7wc — com.squareup.wire:wire-runtime: upgrade to the fixed version with the command below.

# pom.xml: bump <version>5.2.0</version> for com.squareup.wire:wire-runtime

Details

Square Wire before 5.2.0 does not enforce a recursion limit on nested groups in ByteArrayProtoReader32.kt and ProtoReader.kt.

Are you affected?

Enter the version of the package you're using.

Affected packages

Maven/com.squareup.wire:wire-runtime
Introduced in: 0Fixed in: 5.2.0
Fix# pom.xml: bump <version>5.2.0</version> for com.squareup.wire:wire-runtime

References