EUVD-2026-44951
GHSA-f9qc-qg88-7pq5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Default preserve_unknown_fields=true makes any network-exposed buffa service unauthenticated and exploitable at low complexity; process crash via OOM is high availability impact.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.8.0, the decode_unknown_field function in buffa's protobuf decoder allocated heap memory in proportion to untrusted input (unknown fields in the serialized protobuf) without enforcing an allocation budget, affecting any message decoded from untrusted input using code generated with preserve_unknown_fields=true (the default); a small, well-formed payload of nested unknown fields inside a StartGroup could trigger roughly 22x memory amplification (for example a 64 MiB input forcing about 1.4 GB of heap allocation), and length-delimited unknown fields could be sized arbitrarily, so an unauthenticated attacker could crash a process through memory exhaustion because the top-level message size cap did not account for in-decode amplification. This issue is fixed in version 0.8.0.
AnalysisAI
Uncontrolled heap amplification in Buffa's protobuf decoder allows an unauthenticated remote attacker to crash any network-facing Rust service that decodes untrusted protobuf input under the default code-generation settings, with no exploit code required beyond a well-formed serialized message. The amplification mechanism - roughly 22× for nested StartGroup unknown fields - means a 64 MiB payload can force approximately 1.4 GiB of heap allocation, exhausting process memory and terminating the service. No active exploitation is confirmed (not in CISA KEV), and no public proof-of-concept has been identified at time of analysis, but the attack is trivially constructible from the public advisory.
Technical ContextAI
Buffa (CPE: cpe:2.3:a:anthropics:buffa:*:*:*:*:*:*:*:*) is a pure-Rust Protocol Buffers implementation with protobuf editions support, authored by Anthropic. The root cause is CWE-400 (Uncontrolled Resource Consumption): the decode_unknown_field function materializes each unknown wire field encountered during deserialization into a heap-allocated UnknownField struct (~40 bytes per record) without tracking or bounding the cumulative allocation against a budget. The existing with_max_message_size cap governed only the byte length of the serialized input, not the number of decoded field objects produced from it. Two wire types drove amplification: StartGroup unknown fields, where nesting allowed recursive materialization producing ~22× memory expansion (e.g., 2-byte varint unknown fields inflated to ~40-byte heap objects), and length-delimited unknown fields, which were bounded only by input size. The vulnerability affected any caller using code generated with the preserve_unknown_fields=true option, which is the default for all generated messages, making the attack surface coincident with any network-exposed buffa-based service that processes untrusted serialized data.
RemediationAI
The primary fix is to upgrade Buffa to version 0.8.0, available at https://github.com/anthropics/buffa/releases/tag/v0.8.0. This release introduces a per-decode unknown-field count limit (default: 1,000,000 fields, capping overhead at approximately 40 MB) enforced via a new DecodeContext that propagates through the entire decode call tree, and surfaces limit violations as DecodeError::UnknownFieldLimitExceeded. Regenerating protobuf code with the new codegen (required due to the breaking DecodeContext API change replacing bare depth: u32) is mandatory - applications using code generated by earlier releases will not benefit from the fix until regenerated. As a compensating control for services that cannot immediately upgrade, restricting the maximum accepted request body size at the network layer (reverse proxy or load balancer) reduces - but does not eliminate - amplification headroom, since the attack is bounded by input size; note this does not remove the fundamental unbounded allocation. Disabling preserve_unknown_fields via code-generation config eliminates the vulnerable path entirely but may break round-trip compatibility for applications that rely on preserving unknown fields. The tune-able limit is also configurable via DecodeOptions::with_unknown_field_limit for callers that need a tighter bound.
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today