{"id":"CVE-2026-55407","sourceIdentifier":"security-advisories@github.com","published":"2026-07-16T17:16:57.770","lastModified":"2026-10-24T20:10:00.137","vulnStatus":"Deferred","cveTags":[],"descriptions":[{"lang":"en","value":"Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.8.0, the decode_unknown_field function in buffa's protobuf decoder allocated heap memory in proportion to untrusted input (unknown fields in the serialized protobuf) without enforcing an allocation budget, affecting any message decoded from untrusted input using code generated with preserve_unknown_fields=true (the default); a small, well-formed payload of nested unknown fields inside a StartGroup could trigger roughly 22x memory amplification (for example a 64 MiB input forcing about 1.4 GB of heap allocation), and length-delimited unknown fields could be sized arbitrarily, so an unauthenticated attacker could crash a process through memory exhaustion because the top-level message size cap did not account for in-decode amplification. This issue is fixed in version 0.8.0."},{"lang":"es","value":"Buffa es una implementación pura en Rust de Protocol Buffers con soporte de primera clase para ediciones de protobuf. Antes de la versión 0.8.0, la función “decode_unknown_field” en el decodificador de protobuf de Buffa asignaba memoria del montón en proporción a la entrada no confiable (campos desconocidos en el protobuf serializado) sin aplicar un presupuesto de asignación, afectando cualquier mensaje decodificado de entrada no confiable usando código generado con “preserve_unknown_fields=true” (el valor predeterminado); una carga útil pequeña y bien formada de campos desconocidos anidados dentro de un “StartGroup” podría desencadenar aproximadamente una amplificación de memoria de 22x (por ejemplo, una entrada de 64 MiB forzando aproximadamente 1.4 GB de asignación de memoria del montón), y los campos desconocidos delimitados por longitud podrían tener un tamaño arbitrario, por lo que un atacante no autenticado podría bloquear un proceso por agotamiento de memoria porque el límite de tamaño del mensaje de nivel superior no tenía en cuenta la amplificación durante la decodificación. Este problema está solucionado en la versión 0.8.0."}],"affected":[{"source":"security-advisories@github.com","affectedData":[{"vendor":"anthropics","product":"buffa","versions":[{"version":"< 0.8.0","status":"affected"}]}]}],"metrics":{"cvssMetricV40":[{"source":"security-advisories@github.com","type":"Secondary","cvssData":{"version":"4.0","vectorString":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","baseScore":6.3,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","attackRequirements":"PRESENT","privilegesRequired":"NONE","userInteraction":"NONE","vulnConfidentialityImpact":"NONE","vulnIntegrityImpact":"NONE","vulnAvailabilityImpact":"LOW","subConfidentialityImpact":"NONE","subIntegrityImpact":"NONE","subAvailabilityImpact":"NONE","exploitMaturity":"NOT_DEFINED","confidentialityRequirement":"NOT_DEFINED","integrityRequirement":"NOT_DEFINED","availabilityRequirement":"NOT_DEFINED","modifiedAttackVector":"NOT_DEFINED","modifiedAttackComplexity":"NOT_DEFINED","modifiedAttackRequirements":"NOT_DEFINED","modifiedPrivilegesRequired":"NOT_DEFINED","modifiedUserInteraction":"NOT_DEFINED","modifiedVulnConfidentialityImpact":"NOT_DEFINED","modifiedVulnIntegrityImpact":"NOT_DEFINED","modifiedVulnAvailabilityImpact":"NOT_DEFINED","modifiedSubConfidentialityImpact":"NOT_DEFINED","modifiedSubIntegrityImpact":"NOT_DEFINED","modifiedSubAvailabilityImpact":"NOT_DEFINED","Safety":"NOT_DEFINED","Automatable":"NOT_DEFINED","Recovery":"NOT_DEFINED","valueDensity":"NOT_DEFINED","vulnerabilityResponseEffort":"NOT_DEFINED","providerUrgency":"NOT_DEFINED"}}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"timestamp":"2026-07-16T18:03:55.427453Z","id":"CVE-2026-55407","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}]},"weaknesses":[{"source":"security-advisories@github.com","type":"Secondary","description":[{"lang":"en","value":"CWE-400"},{"lang":"en","value":"CWE-770"},{"lang":"en","value":"CWE-789"}]}],"references":[{"url":"https://github.com/anthropics/buffa/commit/278fa43fcff661d4ee6bd83b75955a153d4281fc","source":"security-advisories@github.com"},{"url":"https://github.com/anthropics/buffa/pull/184","source":"security-advisories@github.com"},{"url":"https://github.com/anthropics/buffa/releases/tag/v0.8.0","source":"security-advisories@github.com"},{"url":"https://github.com/anthropics/buffa/security/advisories/GHSA-f9qc-qg88-7pq5","source":"security-advisories@github.com"}]}