From 9842305646575bd9b05dc2ce5b93b463f58b812b Mon Sep 17 00:00:00 2001
From: James Netherton <jamesnetherton@gmail.com>
Date: Wed, 9 Sep 2026 15:53:05 +0100
Subject: [PATCH] Pin com.squareup.wire:wire-runtime to 6.4.7 to remediate
 CVE-2026-45799

amazon-kinesis-client pulls software.amazon.glue:schema-registry-serde, which
pins Square Wire at 5.2.0. skipGroup() before Wire 6.3.0 does not reject a
negative LENGTH_DELIMITED length, so a crafted payload makes
ProtoAdapter.decode(byte[]) throw an unchecked ArrayIndexOutOfBoundsException
instead of the documented IOException. schema-registry-serde 1.1.27 is the
latest release and is still on Wire 5.2.0, so the version is managed here.

Only wire-runtime is bumped. wire-schema, wire-compiler and the Wire code
generators stay at 5.2.0 because the Glue serde binds to
com.squareup.wire.schema.internal.parser.ProtoFileElement, whose constructor
gained a parameter in Wire 5.3.0 - aligning every Wire artifact breaks
FileDescriptorUtils with a NoSuchMethodError. No Wire release has both the
9-arg constructor and the CVE fix, so splitting the versions is the only
combination that satisfies both.

wire-runtime is an empty Kotlin-Multiplatform metadata artifact; wire-runtime-jvm
carries all the classes and is the entry that applies the fix. Both are pinned
because the advisory lists both coordinates.

Camel itself never reaches the vulnerable code: the Glue serde uses Wire only as
a .proto schema-text parser, and the KCL consumer never enables the Glue schema
registry. This removes a recurring false positive for downstream consumers.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 .../camel-aws/camel-aws2-kinesis/pom.xml      | 20 +++++++++++++++++++
 parent/pom.xml                                |  1 +
 2 files changed, 21 insertions(+)

diff --git a/components/camel-aws/camel-aws2-kinesis/pom.xml b/components/camel-aws/camel-aws2-kinesis/pom.xml
index d878d5f89ef96..e0b7c307184cb 100644
--- a/components/camel-aws/camel-aws2-kinesis/pom.xml
+++ b/components/camel-aws/camel-aws2-kinesis/pom.xml
@@ -32,6 +32,26 @@
     <name>Camel :: AWS2 Kinesis</name>
     <description>Consuming and Producing data to AWS Kinesis Service</description>
 
+    <dependencyManagement>
+        <dependencies>
+            <!-- Pin com.squareup.wire:wire-runtime transitively brought in by amazon-kinesis-client
+                 via software.amazon.glue:schema-registry-serde (still on Wire 5.2.0, no release with
+                 the fix) to remediate CVE-2026-45799. wire-runtime is an empty Kotlin-Multiplatform
+                 stub and wire-runtime-jvm carries the fix; both are pinned because the advisory lists
+                 both coordinates. -->
+            <dependency>
+                <groupId>com.squareup.wire</groupId>
+                <artifactId>wire-runtime</artifactId>
+                <version>${squareup-wire-version}</version>
+            </dependency>
+            <dependency>
+                <groupId>com.squareup.wire</groupId>
+                <artifactId>wire-runtime-jvm</artifactId>
+                <version>${squareup-wire-version}</version>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
+
     <dependencies>
         <dependency>
             <groupId>org.apache.camel</groupId>
diff --git a/parent/pom.xml b/parent/pom.xml
index 0052d902c6e2e..8c20e7c018706 100644
--- a/parent/pom.xml
+++ b/parent/pom.xml
@@ -507,6 +507,7 @@
         <sql-maven-plugin-version>3.0.0</sql-maven-plugin-version>
         <squareup-okhttp5-version>5.5.0</squareup-okhttp5-version>
         <squareup-okio-version>1.17.5</squareup-okio-version>
+        <squareup-wire-version>6.4.7</squareup-wire-version>
         <sshd-version>2.19.0</sshd-version>
         <stompjms-version>1.19</stompjms-version>
         <stripe-java-version>33.4.0</stripe-java-version>