CVE-2026-55407

MediumCVSS 6.3

Published: 16/07/2026(UTC)Updated: 16/07/2026(UTC)Translated: 17/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.57%

43th percentile - higher than 43% of all known CVEs

Summary

A vulnerability in the Buffa library (Rust Protocol Buffers implementation) before version 0.8.0 causes excessive heap memory allocation when decoding unknown fields from untrusted input. An attacker can send a small, crafted protobuf payload triggering roughly 22x memory amplification (e.g., 64 MB input forcing ~1.4 GB allocation), leading to memory exhaustion and process crash.

Risk Assessment

The organization is exposed to a denial-of-service (DoS) attack via remote memory exhaustion on servers or applications processing untrusted protobuf data. Even an unauthenticated attacker can crash critical processes.

Recommendation

Immediately upgrade the Buffa library to version 0.8.0 or later. If upgrading is not possible, consider setting preserve_unknown_fields=false in the code generator for all messages handling untrusted data.

Other vulnerabilities in Buffa

CVE-2026-55406Medium
A soundness bug in the OwnedView<V> type of the Buffa library (a pure-Rust Protocol Buffers implementation) allowed safe Rust code to trigger a use-after-free. The OwnedView::decode constructor incorrectly transmuted a borrowed slice to &'static [u8], and the Deref implementation exposed the promoted 'static lifetime on view fields, enabling access to freed memory.

Original NVD description (English source)

Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.8.0, the decode_unknown_field function in buffa's protobuf decoder allocated heap memory in proportion to untrusted input (unknown fields in the serialized protobuf) without enforcing an allocation budget, affecting any message decoded from untrusted input using code generated with preserve_unknown_fields=true (the default); a small, well-formed payload of nested unknown fields inside a StartGroup could trigger roughly 22x memory amplification (for example a 64 MiB input forcing about 1.4 GB of heap allocation), and length-delimited unknown fields could be sized arbitrarily, so an unauthenticated attacker could crash a process through memory exhaustion because the top-level message size cap did not account for in-decode amplification. This issue is fixed in version 0.8.0.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS