Pin com.squareup.wire:wire-runtime to 6.4.7 to remediate CVE-2026-45799

[jamesnetherton]

amazon-kinesis-client pulls in software.amazon.glue:schema-registry-serde, which pins Square Wire
at 5.2.0. ProtoReader.skipGroup() and ByteArrayProtoReader32.skipGroup() before Wire 6.3.0 do not
reject a negative LENGTH_DELIMITED length, so a crafted 10-byte payload makes
ProtoAdapter.decode(byte[]) throw an unchecked ArrayIndexOutOfBoundsException instead of the
documented IOException (CVE-2026-45799, CVSS 7.5).

Upstream has not fixed this: schema-registry-serde 1.1.27 is the latest release and is still on Wire
5.2.0, so camel-aws2-kinesis manages the version itself.

Only wire-runtime is bumped — please don't align the rest

wire-schema, wire-compiler and the Wire code generators deliberately stay at 5.2.0. The Glue serde
binds to com.squareup.wire.schema.internal.parser.ProtoFileElement, whose constructor gained a
parameter in Wire 5.3.0:

5.2.0   (Location, String, Syntax, List, List, List, List, List, List)          9 args
6.3.0+  (Location, String, Syntax, List, List, List, List, List, List, List)   10 args

FileDescriptorUtils calls the 9-arg form, so aligning every Wire artifact breaks the Glue protobuf
path with a NoSuchMethodError. No Wire release has both the 9-arg constructor and the CVE fix — the
constructor changed in 5.3.0, the fix landed in 6.3.0. Splitting the versions is the only combination
that satisfies both.

Both wire-runtime and wire-runtime-jvm are pinned. wire-runtime is an empty Kotlin-Multiplatform
metadata artifact (0 classes); wire-runtime-jvm carries all 125 classes and is the entry that
actually applies the fix. The advisory lists both coordinates, so both are pinned to keep scanners
quiet.

Is Camel exposed?

No. This clears a false positive rather than fixing a reachable vulnerability:

• Scanning all 246 jars on the component's classpath plus Camel's own classes, only Wire's own jars
  reference ProtoAdapter / ProtoReader. schema-registry-serde (73 classes),
  schema-registry-common (32), amazon-kinesis-client (457) and camel-aws2-kinesis (39) have zero
  references.
• The Glue serde uses Wire only as a .proto schema-text parser (ProtoParser, SchemaLoader).
  Protobuf message decoding goes through com.google.protobuf, not Wire.
• KclKinesis2Consumer builds ConfigsBuilder itself and never sets a Glue deserializer, so
  RetrievalConfig.glueSchemaRegistryDeserializer stays null and KCL branches over the decode step
  entirely. There is no endpoint option or autowired bean to enable it.
• Camel sets the message body to the raw ByteBuffer and performs no deserialization.

It is still worth pinning: it removes a recurring finding for every downstream consumer, and protects
users who put their own Wire-using code on the classpath.

Verification

• Dependency tree moves exactly two artifacts. okio stays 3.4.0 and kotlin-stdlib stays 1.9.25 —
  no other version churn.
• mvn test -pl components/camel-aws/camel-aws2-kinesis — 41/41 green.
• Linkage check of wire-schema-jvm 5.2.0 against wire-runtime-jvm 6.4.7: one unresolved reference,
  RuntimeMessageAdapter.<init>(MessageBinding), whose only caller is SchemaProtoAdapterFactory —
  reachable solely via Schema.protoAdapter(), which the Glue serde never calls (it calls only
  getType, getTypes and protoFile). wire-runtime 6.4.7 resolves cleanly against the okio and
  kotlin-stdlib versions already on the classpath.
• PoC over 90 crafted payloads through ProtoAdapter.decode(byte[]): 60/90 unchecked
  ArrayIndexOutOfBoundsException before the change, 0/90 after (all documented IOException).
• Glue protobuf path exercised end to end — FileDescriptorUtils.protoFileToFileDescriptor on a real
  .proto produces an identical FileDescriptor before and after.

Backports

• 4.22.x — applies cleanly; dependency resolution is identical to main.
• 4.18.x — not backported. That branch resolves Wire 4.3.0 via KCL 2.6.0, and wire-runtime 6.x
  requires Kotlin >= 1.9 (kotlin.enums.EnumEntriesKt) while the branch is on kotlin-stdlib 1.7.10,
  so the pin fails there with a NoClassDefFoundError. Remediating that branch would also require a
  Kotlin stdlib bump.
• 4.14.x — EOL.

The underlying issue needs fixing in aws-glue-schema-registry, which must move off Wire's
internal.parser API before it can take a supported Wire version.

---

Claude Code on behalf of James Netherton

🤖 Generated with Claude Code

[github-actions]

🌟 Thank you for your contribution to the Apache Camel project! 🌟
🤖 CI automation will test this PR automatically.

🐫 Apache Camel Committers, please review the following items:

• First-time contributors require MANUAL approval for the GitHub Actions to run
• You can use the command /component-test (camel-)component-name1 (camel-)component-name2.. to request a test from the test bot although they are normally detected and executed by CI.
• You can label PRs using skip-tests and test-dependents to fine-tune the checks executed by this PR.
• Build and test logs are available in the summary page. Only Apache Camel committers have access to the summary.

⚠️ Be careful when sharing logs. Review their contents before sharing them publicly.

[gnodet]

Clean, well-scoped CVE remediation.

The split-version approach (pinning only wire-runtime/wire-runtime-jvm to 6.4.7 while leaving wire-schema at 5.2.0) is the right call — upgrading wire-schema would break the Glue serde's ProtoFileElement 9-arg constructor call, and no Wire release has both the old constructor and the CVE fix.

Using component-level <dependencyManagement> instead of a parent-level managed dependency correctly limits the blast radius to camel-aws2-kinesis.

Verified:

• wire-runtime 6.4.7 exists on Maven Central (released 2026-08-25)
• CVE-2026-45799 fix landed in Wire 6.3.0
• Property placement in parent/pom.xml follows alphabetical sort convention

Claude Code on behalf of Guillaume Nodet

[github-actions]

🧪 CI tested the following changed modules:

• components/camel-aws/camel-aws2-kinesis
• parent

✅ POM dependency changes: targeted tests included

Changed properties: squareup-wire-version

Modules affected by dependency changes (1)

• :camel-aws2-kinesis

---

🔬 Scalpel shadow comparison — Scalpel: 9 tested, 27 compile-only — current: 9 all tested

Maveniverse Scalpel detected 36 affected modules (current approach: 9).

⚠️ Modules only in Scalpel (27)

• apache-camel
• camel-allcomponents
• camel-catalog
• camel-catalog-console
• camel-catalog-maven
• camel-catalog-suggest
• camel-componentdsl
• camel-endpointdsl
• camel-endpointdsl-support
• camel-itest
• camel-jbang-core
• camel-jbang-it
• camel-jbang-main
• camel-jbang-plugin-edit
• camel-jbang-plugin-generate
• camel-jbang-plugin-kubernetes
• camel-jbang-plugin-test
• camel-kamelet-main
• camel-launcher
• camel-report-maven-plugin
• camel-route-parser
• camel-yaml-dsl
• camel-yaml-dsl-deserializers
• camel-yaml-dsl-maven-plugin
• coverage
• docs
• dummy-component

Changed properties: squareup-wire-version

Skip-tests mode would test 9 modules (1 direct + 8 downstream), skip tests for 27 (generated code, meta-modules)

Modules Scalpel would test (9)

• camel-aws2-kinesis
• camel-jbang-mcp
• camel-jbang-plugin-mcp
• camel-jbang-plugin-route-parser
• camel-jbang-plugin-tui
• camel-jbang-plugin-validate
• camel-launcher-container
• camel-yaml-dsl-validator
• camel-yaml-dsl-validator-maven-plugin

Modules with tests skipped (27)

• apache-camel
• camel-allcomponents
• camel-catalog
• camel-catalog-console
• camel-catalog-maven
• camel-catalog-suggest
• camel-componentdsl
• camel-endpointdsl
• camel-endpointdsl-support
• camel-itest
• camel-jbang-core
• camel-jbang-it
• camel-jbang-main
• camel-jbang-plugin-edit
• camel-jbang-plugin-generate
• camel-jbang-plugin-kubernetes
• camel-jbang-plugin-test
• camel-kamelet-main
• camel-launcher
• camel-report-maven-plugin
• camel-route-parser
• camel-yaml-dsl
• camel-yaml-dsl-deserializers
• camel-yaml-dsl-maven-plugin
• coverage
• docs
• dummy-component

ℹ️ Shadow mode — Scalpel observes but does not affect test execution. Learn more

All tested modules (36 modules, 3m 31s total)

Total reactor time: 3m 31s

Module	Duration	Status
Camel :: YAML DSL	55.1s	SUCCESS
Camel :: Endpoint DSL	54.1s	SUCCESS
Camel :: JBang :: Plugin :: TUI	14.0s	FAILURE
Camel :: Component DSL	13.7s	SUCCESS
Camel :: Catalog :: Camel Catalog	11.0s	SUCCESS
Camel :: Docs	9.3s	SUCCESS
Camel :: JBang :: Plugin :: Kubernetes	9.3s	SUCCESS
Camel :: JBang :: Plugin :: Testing	6.1s	SUCCESS
Camel :: Catalog :: Camel Report Maven Plugin	5.9s	SUCCESS
Camel :: Catalog :: Camel Route Parser	5.3s	SUCCESS
Camel :: Kamelet Main	5.2s	SUCCESS
Camel :: YAML DSL :: Deserializers	4.2s	SUCCESS
Camel :: All Components Sync point	3.3s	SUCCESS
Camel :: YAML DSL :: Validator	3.3s	SUCCESS
Camel :: YAML DSL :: Maven Plugins	2.2s	SUCCESS
Camel :: Catalog :: Suggest	2.0s	SUCCESS
Camel :: YAML DSL :: Validator Maven Plugin	1.9s	SUCCESS
Camel :: Catalog :: Maven	1.3s	SUCCESS
Camel :: Catalog :: Dummy Component	1.1s	SUCCESS
Camel :: Assembly	0.8s	SUCCESS
Camel :: JBang :: Plugin :: MCP	0.7s	SUCCESS
Camel :: JBang :: Plugin :: Validate	0.7s	SUCCESS
Camel :: Endpoint DSL :: Support	0.5s	SUCCESS
Camel :: Catalog :: Console	0.4s	SUCCESS
Camel :: AWS2 Kinesis	n/a
Camel :: Coverage	n/a
Camel :: Integration Tests	n/a
Camel :: JBang :: Core	n/a
Camel :: JBang :: Integration tests	n/a
Camel :: JBang :: MCP	n/a
Camel :: JBang :: Main	n/a
Camel :: JBang :: Plugin :: Edit	n/a
Camel :: JBang :: Plugin :: Generate	n/a
Camel :: JBang :: Plugin :: Route Parser	n/a
Camel :: Launcher	n/a
Camel :: Launcher :: Container	n/a

Top 20 slowest modules:

• Camel :: YAML DSL (55.1s)
• Camel :: Endpoint DSL (54.1s)
• Camel :: JBang :: Plugin :: TUI (14.0s)
• Camel :: Component DSL (13.7s)
• Camel :: Catalog :: Camel Catalog (11.0s)
• Camel :: Docs (9.3s)
• Camel :: JBang :: Plugin :: Kubernetes (9.3s)
• Camel :: JBang :: Plugin :: Testing (6.1s)
• Camel :: Catalog :: Camel Report Maven Plugin (5.9s)
• Camel :: Catalog :: Camel Route Parser (5.3s)
• Camel :: Kamelet Main (5.2s)
• Camel :: YAML DSL :: Deserializers (4.2s)
• Camel :: All Components Sync point (3.3s)
• Camel :: YAML DSL :: Validator (3.3s)
• Camel :: YAML DSL :: Maven Plugins (2.2s)
• Camel :: Catalog :: Suggest (2.0s)
• Camel :: YAML DSL :: Validator Maven Plugin (1.9s)
• Camel :: Catalog :: Maven (1.3s)
• Camel :: Catalog :: Dummy Component (1.1s)
• Camel :: Assembly (0.8s)

---

⚙️ View full build and test results