MEDIUM GitHub
CVE-2026-55407
Buffa Vulnerable to Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded Allocation
The `decode_unknown_field` function in buffa's protobuf decoder allocated heap memory in proportion to untrusted input (unknown fields in the serialized protobuf) without enforcing an allocation budget. Any message decoded from untrusted input using code generated with `preserve_unknown_fields=true` (the default) was affected. A small, well-formed payload of nested unknown fields inside a StartGroup could trigger roughly 22× memory amplification (e.g., a 64 MiB input forcing ~1.4 GB of heap allo
Affected Products
- rust/buffa < 0.8.0
References
- https://github.com/advisories/GHSA-f9qc-qg88-7pq5
- https://github.com/anthropics/buffa/security/advisories/GHSA-f9qc-qg88-7pq5
- https://nvd.nist.gov/vuln/detail/CVE-2026-55407
- https://github.com/anthropics/buffa/pull/184
This medium severity vulnerability was published on 2026-08-28 via GitHub. Affected: rust/buffa < 0.8.0.
vulnfeed aggregates 11493 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.