What is GHSA-pwf9-q62p-v7wc?

GHSA-pwf9-q62p-v7wc is a security advisory published by GitHub Security Advisories with Medium severity. Wire has Uncontrolled Recursion on Nested Groups

Which CVE IDs does GHSA-pwf9-q62p-v7wc cover?

GHSA-pwf9-q62p-v7wc covers the following CVE IDs: CVE-2024-58103. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-pwf9-q62p-v7wc?

GHSA-pwf9-q62p-v7wc has a CVSS v3 base score of 5.8, published by GitHub Security Advisories.

Which products are affected by GHSA-pwf9-q62p-v7wc?

GHSA-pwf9-q62p-v7wc affects 1 product, including: maven/com.squareup.wire:wire-runtime:\u003c 5.2.0.

GHSA-pwf9-q62p-v7wcMediumCVSS 5.8

Wire has Uncontrolled Recursion on Nested Groups

Vendor

GitHub Security Advisories

Published

March 16, 2025

Last Modified

March 18, 2025

🔗 CVE IDs covered (1)

CVE-2024-58103 →

📋 Description

Square Wire before 5.2.0 does not enforce a recursion limit on nested groups in ByteArrayProtoReader32.kt and ProtoReader.kt.

🎯 Affected products1

maven/com.squareup.wire:wire-runtime:< 5.2.0

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2024-58103
https://github.com/square/wire/commit/b90e60c09befaff836a2fc2ee4d678451b2ec75d
https://github.com/square/wire/compare/5.1.0...5.2.0
https://github.com/advisories/GHSA-pwf9-q62p-v7wc