Buffa Protobuf Decoder Vulnerability: Memory Exhaustion Risk
- Severity
- HIGH
- Affected component
- buffa (cargo)
- Affected versions
- < 0.7.0 or < 0.8.0
- Patched version
- 0.8.0
An early warning has been issued for a vulnerability in buffa's protobuf decoder that could allow an unauthenticated attacker to cause a denial of service via memory exhaustion. Users of versions less than 0.7.0 or 0.8.0 are reportedly affected.
What happened
The vulnerability, tracked as GHSA-f9qc-qg88-7pq5, lies in the `decode_unknown_field` function of buffa's protobuf decoder. This function allocates heap memory in proportion to untrusted input without enforcing an allocation budget, which an attacker could exploit to crash a process by exhausting its memory. The issue has not been exploited in the wild as of the latest reports.
This vulnerability was first flagged on 2026-08-28. The severity is classified as high, and the attack type is categorized as 'other'. There is no indication of a supply-chain attack at this time. The vulnerability is under investigation, and further details should be obtained from the primary sources.
What to do about it
- Upgrade to buffa version 0.8.0 to mitigate the risk.
- Alternatively, set `preserve_unknown_fields=false` on your current generated code to reduce exposure.
- Monitor the primary sources for updates on the vulnerability and any additional mitigations that may be recommended.
How 0Day would have caught this
buffa is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
You are reportedly affected if you are using buffa versions less than 0.7.0 or 0.8.0.
What should I do right now?
Upgrade to buffa version 0.8.0 or set `preserve_unknown_fields=false` on your current generated code.
Has this been exploited in the wild?
There is no report of this vulnerability being exploited in the wild as of the latest information.