An unauthenticated remote denial-of-service vulnerability exists in the length-delimited protocol buffer decoding mechanism of the target runtime library. Malformed protobuf payloads containing large positive integer lengths bypass initial bounds validation, leading to signed integer overflow and invalid message limit calculations. Instead of safely failing with checked parsing errors, affected endpoints throw unchecked runtime exceptions or trigger process traps. This memory and state management logic failure allows remote attackers to crash request-handling processes or entire service instances with minimal effort. The security issue carries a CVSS v3 base score of 7.5, reflecting a high-severity availability impact across affected decoding pathways.
CVE-2026-63126: This vulnerability involves an integer overflow flaw within the byte-array and buffer decoding components, specifically affecting integer length checks during protobuf parsing. Remote attackers can transmit crafted length-delimited inputs to trigger unchecked runtime exceptions, bounds violations, or process crashes. Successful exploitation results in an immediate denial-of-service condition affecting service availability. Unauthenticated network access to any endpoint performing protocol buffer deserialization is sufficient to exploit this flaw.[/subscribe_to_unlock_form]
An unauthenticated remote denial-of-service vulnerability exists in the length-delimited protocol buffer decoding mechanism of the target runtime library. Malformed protobuf payloads containing large positive integer lengths bypass initial bounds validation, leading to signed integer overflow and invalid message limit calculations. Instead of safely failing with checked parsing errors, affected endpoints throw unchecked runtime exceptions or trigger process traps. This memory and state management logic failure allows remote attackers to crash request-handling processes or entire service instances with minimal effort. The security issue carries a CVSS v3 base score of 7.5, reflecting a high-severity availability impact across affected decoding pathways.
CVE-2026-63126: This vulnerability involves an integer overflow flaw within the byte-array and buffer decoding components, specifically affecting integer length checks during protobuf parsing. Remote attackers can transmit crafted length-delimited inputs to trigger unchecked runtime exceptions, bounds violations, or process crashes. Successful exploitation results in an immediate denial-of-service condition affecting service availability. Unauthenticated network access to any endpoint performing protocol buffer deserialization is sufficient to exploit this flaw.[emaillocker id="1283"]
Organizations processing untrusted protocol buffer payloads must update affected runtime library dependencies to patched versions immediately to enforce strict bounds validation. If immediate upgrading is unfeasible, implement edge validation controls to reject or cap payload sizes before passing raw byte structures to the parsing logic. Additionally, wrap protocol buffer deserialization boundaries in strict exception-handling wrappers to intercept unchecked runtime errors and prevent process termination.
We recommend you to update Wire to version 6.4.5 or 7.0.0-alpha04.
The following reports contain further technical details:
[/emaillocker]