Executive brief
Buffa is a Rust protobuf code generator used to serialize and deserialize message data. The library's default behavior of preserving unknown fields in decoded messages allows an attacker to send specially crafted protobuf payloads that consume excessive heap memory without triggering size limits. A small malicious message can force the decoder to allocate many times its own size in memory, enabling an unauthenticated remote attacker to crash services through memory exhaustion with minimal network traffic.
Technical details
The decode_unknown_field function in buffa's protobuf decoder fails to enforce allocation limits on heap memory consumed during decoding of unknown fields from untrusted protobuf messages. By default, generated code preserves unknown fields, and the top-level message size cap does not account for in-decode memory amplification. Nested unknown fields within a StartGroup can achieve approximately 22× amplification (e.g., a 64 MiB input forcing ~1.4 GB allocation); length-delimited unknown fields can be sized arbitrarily, offering even greater amplification. The vulnerability is reachable from default decode APIs without authentication or user interaction. Version 0.8.0 fixes this by enforcing per-message unknown field count limits (default 1 million fields, ~40 MiB overhead). Mitigation for older versions includes setting preserve_unknown_fields=false or implementing external size limits (e.g., connectrpc's 4 MiB default still allows ~88 MiB amplification).
Affected products
- Anthropics buffa < 0.8.0
Timeline
- 2026-07-01: disclosed
- 2026-07-16: advisory
- 2026-08-28: patched