GHSA-f9qc-qg88-7pq5

Suggest an improvement
Source
https://github.com/advisories/GHSA-f9qc-qg88-7pq5
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-f9qc-qg88-7pq5/GHSA-f9qc-qg88-7pq5.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-f9qc-qg88-7pq5
Aliases
Published
2026-08-28T18:34:22Z
Modified
2026-08-28T18:45:06Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
Buffa Vulnerable to Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded Allocation
Details

The decode_unknown_field function in buffa's protobuf decoder allocated heap memory in proportion to untrusted input (unknown fields in the serialized protobuf) without enforcing an allocation budget. Any message decoded from untrusted input using code generated with preserve_unknown_fields=true (the default) was affected. A small, well-formed payload of nested unknown fields inside a StartGroup could trigger roughly 22× memory amplification (e.g., a 64 MiB input forcing ~1.4 GB of heap allocation), and length-delimited unknown fields could be sized arbitrarily, enabling an unauthenticated attacker to crash a process via memory exhaustion. This was reachable from the default decode APIs, since the top-level message size cap did not account for in-decode amplification.

For users of connectrpc - the DEFAULT_MAX_MESSAGE_SIZE for connectrpc is 4MiB, which limits amplification in the worst case to ~88 MiB of memory. A flood of concurrent requests with this pattern could still be used to exhaust available memory, however.

Users are advised to either set preserve_unknown_fields=false on their current generated code, or upgrade to 0.8.0, which enforces per-message unknown field count limits - this is configurable, with a default of 1 million unknown fields, or ~40MiB of allocation overhead per message. Users are advised to update to the latest version, which enforces per-message unknown field count limits.

Thank you to @p80n-sec for reporting this issue.

Database specific 
{
    "cwe_ids": [
        "CWE-400",
        "CWE-770",
        "CWE-789"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-28T18:34:22Z",
    "nvd_published_at": "2026-07-16T17:16:57Z",
    "severity": "MODERATE"
}
References

Affected packages

crates.io / buffa

Package

Name
buffa
View open source insights on deps.dev
Purl
pkg:cargo/buffa

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.8.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/08/GHSA-f9qc-qg88-7pq5/GHSA-f9qc-qg88-7pq5.json"