Skip to content
OpenAdvisories

Package · crates.io

buffa

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

2 results · Clear filters · Feed

  • Medium 6.3
    CVE-2026-55407

    Buffa: Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded Allocation

    Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.8.0, the decode_unknown_field function in buffa's protobuf decoder allocated heap memory in proportion to untrusted input (unknown fields in the serial…

    anthropics buffa buffa crates.io
  • Medium 5.9
    CVE-2026-55406

    Buffa: Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref

    Buffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.7.0, a soundness bug in the OwnedView<V> type allowed safe Rust code to trigger a use-after-free: the OwnedView::decode constructor transmuted a borrow…

    anthropics buffa buffa crates.io