Anthropic buffa Library Hit by Zero-Day DoS Flaw in Rust Protobuf Decoder

A denial-of-service vulnerability in buffa, Anthropic’s Rust protobuf library, shows that even memory-safe code from a frontier AI lab isn’t immune to allocation-budget flaws.

Tracked as CVE-2026-55407 (CVSS 4.0: 6.3, Moderate), the bug was uncovered by Endor Labs’ AI SAST engine, which traced attacker-controlled wire data through an unbounded allocation path rather than relying on simple pattern matching.

The flaw lives in decode_unknown_field inside buffa/src/encoding.rs. Any message decoded with preserve_unknown_fields=true (the default) routes untrusted input through this function, making every buffer-decoded message a potential target.

Anthropic buffa Library Flaw

Two distinct sinks emerged:

• Flat LengthDelimited allocation: A length value (len) parsed directly from wire data feeds a Vec<u8> allocation with no upper bound beyond fitting a usize. This produces roughly 2x amplification, bounded by any reasonable input-size cap.
• StartGroup amplification: The nested-group decoding loop pushes an UnknownField (~40 bytes) into memory for every 2-byte varint field. This yields roughly 22x amplification, turning a 64 MiB payload into approximately 1.4 GB of heap usage.

Buffa’s own documentation acknowledged the allocation risk but shifted the mitigation burden onto callers, recommending input-size limits.

That advice holds for the flat sink but fails against the group-amplification vector, since a 64 MiB input cap still permits a 1.4 GB memory spike, enough to OOM-kill processes with generous memory ceilings.

Testing in a Docker container with a 256 MiB memory cap confirmed the crash: a 64 MiB payload of nested zero-value varints inside a single unknown group triggered an OOM-kill (exit code 137), validating both the flat and amplified attack paths.

The researcher emphasized the assumptions behind the CVSS score. Anthropic scored the issue at 6.3 based on a deployment model with supervised replicas and automatic restarts, in which a single worker OOM causes only degraded throughput.

However, single-instance deployments, file-ingestion pipelines, or standard gRPC configurations with default message limits could experience High-to-Critical impact, since a small, repeatable, unauthenticated trigger can crash-loop-restart workers indefinitely.

Anthropic patched the issue in buffa and connectrpc 0.8.0, enforcing a configurable per-message unknown-field count limit (default: 1 million fields, capping overhead at ~40 MB).

Endor Labs stated that users unable to upgrade immediately can regenerate code with preserve_unknown_fields=false to remove the vulnerable code path entirely.

The researcher praised Anthropic’s security team for a collaborative disclosure process, including detailed technical discussion over CVSS metric disagreements, despite the parties not fully aligning on final severity.

The case highlights the value of data-flow-based static analysis on memory-safe languages, where traditional grep-based vulnerability hunting comes up empty.

Following a single flagged data flow, one branch further uncovered a substantially more dangerous amplification vector, underscoring that automated tools are most valuable when paired with manual follow-through on the paths they surface.

Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.