Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded Allocation
Medium6.3CVE-2026-55407 · Published Jul 1, 2026
The `decode_unknown_field` function in buffa's protobuf decoder allocated heap memory in proportion to untrusted input (unknown fields in the serialized protobuf) without enforcing an allocation budget. Any message decoded from untrusted input using code generated with `preserve_unknown_fields=true` (the default) was affected. A small, well-formed payload of nested unknown fields inside a StartGroup could trigger roughly 22× memory amplification (e.g., a 64 MiB input forcing ~1.4 GB of heap allocation), and length-delimited unknown fields could be sized arbitrarily, enabling an unauthenticated attacker to crash a process via memory exhaustion. This was reachable from the default decode APIs, since the top-level message size cap did not account for in-decode amplification. For users of connectrpc - the DEFAULT_MAX_MESSAGE_SIZE for connectrpc is 4MiB, which limits amplification in the worst case to ~88 MiB of memory. A flood of concurrent requests with this pattern could still be used to exhaust available memory, however. Users are advised to either set `preserve_unknown_fields=false` on their current generated code, or upgrade to 0.8.0, which enforces per-message unknown field cou...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| buffa crates.io | < 0.8.0 | 0.8.0 |
| connectrpc crates.io | < 0.8.0 | 0.8.0 |
Details and references
The `decode_unknown_field` function in buffa's protobuf decoder allocated heap memory in proportion to untrusted input (unknown fields in the serialized protobuf) without enforcing an allocation budget. Any message decoded from untrusted input using code generated with `preserve_unknown_fields=true` (the default) was affected. A small, well-formed payload of nested unknown fields inside a StartGroup could trigger roughly 22× memory amplification (e.g., a 64 MiB input forcing ~1.4 GB of heap allocation), and length-delimited unknown fields could be sized arbitrarily, enabling an unauthenticated attacker to crash a process via memory exhaustion. This was reachable from the default decode APIs, since the top-level message size cap did not account for in-decode amplification. For users of connectrpc - the DEFAULT_MAX_MESSAGE_SIZE for connectrpc is 4MiB, which limits amplification in the worst case to ~88 MiB of memory. A flood of concurrent requests with this pattern could still be used to exhaust available memory, however. Users are advised to either set `preserve_unknown_fields=false` on their current generated code, or upgrade to 0.8.0, which enforces per-message unknown field count limits - this is configurable, with a default of 1 million unknown fields, or ~40MiB of allocation overhead per message. Users are advised to update to the latest version, which enforces per-message unknown field count limits. Thank you to @p80n-sec for reporting this issue.
More Anthropic advisories
All Anthropic| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jul 1 | Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref | Medium5.9 | 0.7.0 |
| Jun 25 | Insecure Temporary File in /copy Command Enables Response Disclosure and Symlink-Based File Write | Medium4.4 | 2.1.128 |
| Jun 25 | Sandbox Escape via Git Worktree Path Confusion Allows Unsandboxed Code Execution | High7.7 | 2.1.163 |
| Jun 13 | Out-of-Band Data Exfiltration via Pre-Approved HuggingFace Domain in WebFetch | Medium6.0 | 2.1.163 |
| May 20 | Malicious MCP Server Configuration in PRs Enables Remote Code Execution and Secret Exfiltration | Medium5.3 | 1.0.74 |
| May 6 | SSH Host Key Verification Bypass Allows Man-in-the-Middle Attack on Remote Sessions | High7.4 | 1.4304.0 |