Square Wire Recursion Limit Vulnerability in Proto Reader Components

A vulnerability exists in Square Wire versions prior to 5.2.0, where the application fails to enforce a recursion limit on nested groups within the ProtoReader components. This oversight can potentially lead to excessive memory usage or stack overflow errors.

Impact

Exploitation of this vulnerability can cause a denial-of-service condition by leading to a stack overflow, which can disrupt the normal operation of the application.

Reproduction

The vulnerability can be reproduced by using a version of Square Wire prior to 5.2.0 and creating a nested group structure that exceeds the default recursion limit. This can be done by crafting a Protocol Buffers message that includes repeated fields, which can be packed to create a deep nesting of groups. The ProtoReader will not properly enforce the recursion limit, leading to a stack overflow.

Remediation

Users can upgrade to Square Wire version 5.2.0 or later, where this vulnerability has been addressed.