CVE-2026-55407 Details
Description
Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.8.0, the decode_unknown_field function in buffa's protobuf decoder allocated heap memory in proportion to untrusted input (unknown fields in the serialized protobuf) without enforcing an allocation budget, affecting any message decoded from untrusted input using code generated with preserve_unknown_fields=true (the default); a small, well-formed payload of nested unknown fields inside a StartGroup could trigger roughly 22x memory amplification (for example a 64 MiB input forcing about 1.4 GB of heap allocation), and length-delimited unknown fields could be sized arbitrarily, so an unauthenticated attacker could crash a process through memory exhaustion because the top-level message size cap did not account for in-decode amplification. This issue is fixed in version 0.8.0.
A memory exhaustion vulnerability has been identified in the Buffa Protocol Buffers library, specifically in versions prior to 0.8.0. The issue arises in the 'decode_unknown_field' function, where heap memory is allocated based on untrusted input (unknown fields in serialized Protobuf) without any allocation budget. This vulnerability affects messages decoded from untrusted sources using code generated with 'preserve_unknown_fields=true', which is the default setting. Exploitation of this vulnerability could lead to a process crash due to excessive memory consumption, as the top-level message size cap does not consider the amplification caused by decoding unknown fields.
Users are advised to update to Buffa version 0.8.0 or later, which includes a fix for this vulnerability by enforcing per-message limits on unknown fields. Alternatively, users can set 'preserve_unknown_fields=false' in their generated code to mitigate the issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 16, 2026CISA-ADP
Assessed Jul 16, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/anthropics/buffa/commit/278fa43fcff661d4ee6bd83b75955a153d4281fc | [email protected] | Source CodeVendor |
| https://github.com/anthropics/buffa/pull/184 | [email protected] | Source CodeVendor |
| https://github.com/anthropics/buffa/releases/tag/v0.8.0 | [email protected] | Release NotesVendor |
| https://github.com/anthropics/buffa/security/advisories/GHSA-f9qc-qg88-7pq5 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
| CWE-789 | Memory Allocation with Excessive Size Value | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Anthropics Buffa | < 0.8.0 (semver) |
CPE
Remediation
| |
| ConnectRPC | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 16, 2026 | CVE Modified | CISA-ADP |
| Jul 16, 2026 | New CVE Received | [email protected] |