THREATOPS

THREAT OPS › Threat News › [GHSA] GHSA-f9qc-qg88-7pq5 (medium) — Buffa Vulnerable to Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded Allocation

[GHSA] GHSA-f9qc-qg88-7pq5 (medium) — Buffa Vulnerable to Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded Allocation

medgithub_advisoriesPublished 2026-08-28

GHSA-f9qc-qg88-7pq5 Severity: medium CVE: CVE-2026-55407

Buffa Vulnerable to Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded Allocation

The `decode_unknown_field` function in buffa's protobuf decoder allocated heap memory in proportion to untrusted input (unknown fields in the serialized protobuf) without enforcing an allocation budget. Any message decoded from untruste

Indicators of compromise

CVE-2026-55407cve

Original source: https://github.com/advisories/GHSA-f9qc-qg88-7pq5