CVE-2024-58103: Wire has Uncontrolled Recursion on Nested Groups

March 16, 2025 (updated March 18, 2025)

Square Wire before 5.2.0 does not enforce a recursion limit on nested groups in ByteArrayProtoReader32.kt and ProtoReader.kt.

References

github.com/advisories/GHSA-pwf9-q62p-v7wc
github.com/square/wire
github.com/square/wire/commit/b90e60c09befaff836a2fc2ee4d678451b2ec75d
github.com/square/wire/compare/5.1.0...5.2.0
nvd.nist.gov/vuln/detail/CVE-2024-58103

Code Behaviors & Features

Detect and mitigate CVE-2024-58103 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →