Buffa CVE-2026-55407

Exploitation requires three conditions to be simultaneously satisfied. First, the target application must be compiled against a version of Buffa prior to 0.8.0. Second, the affected application code must have been generated with preserve_unknown_fields=true, which is the default setting for all Buffa code generation - this means the vast majority of Buffa deployments are vulnerable without any non-default configuration. Third, the application must decode untrusted network input as a protobuf message (i.e., the service must be reachable by the attacker and accept serialized protobuf). Exploitation is not limited by authentication (PR:N) or user interaction (UI:N). The primary limiting factor for exploitation is the preserve_unknown_fields condition - however, since it is the default, defenders should assume all Buffa services are affected unless code-generation settings are explicitly audited. The attack does not require knowledge of the target message schema, as unknown fields are processed regardless of the defined message type.

The CVSS 4.0 score of 6.3 with VA:L (low vulnerable-system availability impact) appears to understate real-world severity given the 22× amplification ratio described - a single moderately sized request crashing a process constitutes a complete denial of service, which typically warrants VA:H. The AT:P attack requirement (attack prerequisites present) reflects the dependency on preserve_unknown_fields=true, but since this is the default configuration for all generated code, the effective attack surface is nearly every buffa deployment. PR:N and UI:N confirm unauthenticated, interaction-free exploitation. EPSS data is not provided; however, the deterministic, low-complexity nature of crafting the exploit payload (well-formed protobuf with nested StartGroup fields) makes opportunistic scripted exploitation feasible once the vulnerability becomes broadly known. No KEV listing and no known POC constrain current observed exploitation. The primary limiting factor is prevalence - Buffa is a niche library - but organizations using it in internet-facing services should treat this as a high operational priority.

An attacker with network access to any service that accepts serialized protobuf input sends a crafted 64 MiB message containing deeply nested StartGroup unknown fields. The buffa decoder materializes each unknown record into a ~40-byte heap struct without bound, driving allocation to approximately 1.4 GiB; the OS OOM killer or process allocator terminates the service. The attack requires no authentication and no specific prior knowledge of the target schema - unknown fields are by definition not validated against any schema - making it applicable to any exposed protobuf endpoint backed by buffa-generated code under default settings.