← All advisories

Medium severity5.8OSV Advisory· Published Mar 16, 2025· Updated Apr 15, 2026

CVE-2024-58103

CVE-2024-58103

Description

Square Wire before 5.2.0 does not enforce a recursion limit on nested groups in ByteArrayProtoReader32.kt and ProtoReader.kt.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
com.squareup.wire:wire-runtimeMaven	< 5.2.0	5.2.0

Affected products

14

Square/WireOSV
Range: 3.0.0, 3.0.0-alpha01, 3.0.0-alpha02, …
osv-coords13 versions
pkg:apk/chainguard/apache-nifi pkg:apk/chainguard/apache-nifi-compat pkg:apk/chainguard/apache-nifi-toolkit pkg:apk/chainguard/apicurio-registry pkg:apk/chainguard/apicurio-registry-nginx-config pkg:apk/chainguard/apicurio-registry-ui pkg:apk/wolfi/apache-nifi pkg:apk/wolfi/apache-nifi-compat pkg:apk/wolfi/apache-nifi-toolkit pkg:apk/wolfi/apicurio-registry pkg:apk/wolfi/apicurio-registry-nginx-config pkg:apk/wolfi/apicurio-registry-ui pkg:maven/com.squareup.wire/wire-runtime
< 2.3.0-r3+ 12 more
- (no CPE)range: < 2.3.0-r3
- (no CPE)range: < 2.3.0-r3
- (no CPE)range: < 2.3.0-r3
- (no CPE)range: < 3.1.2-r0
- (no CPE)range: < 3.1.2-r0
- (no CPE)range: < 3.1.2-r0
- (no CPE)range: < 2.3.0-r3
- (no CPE)range: < 2.3.0-r3
- (no CPE)range: < 2.3.0-r3
- (no CPE)range: < 3.1.2-r0
- (no CPE)range: < 3.1.2-r0
- (no CPE)range: < 3.1.2-r0
- (no CPE)range: < 5.2.0

Patches

Vulnerability mechanics

References

4

github.com/advisories/GHSA-pwf9-q62p-v7wcghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2024-58103ghsaADVISORY
github.com/square/wire/commit/b90e60c09befaff836a2fc2ee4d678451b2ec75dnvdWEB
github.com/square/wire/compare/5.1.0...5.2.0nvdWEB

News mentions

0

No linked articles in our index yet.