Buffa is a pure‑Rust Protocol Buffers implementation. In versions earlier than 0.8.0, the function decode_unknown_field allocated heap memory proportional to untrusted input when preserve_unknown_fields=True. Because no allocation budget was enforced, a small, well‑formed protobuf containing nested unknown fields could trigger large memory amplification, causing up to 1.4 GB of heap consumption from a 64 MiB payload. When the decoder processes such data, the process can exhaust available memory and crash, leading to a denial of service.

All released versions of Buffa by anthropics prior to the 0.8.0 update are affected. Any application that uses Buffa to decode untrusted protobuf messages with the default preserve_unknown_fields=true setting is vulnerable, including services or libraries that accept client data or external data sources.

The CVSS score of 6.3 indicates moderate severity. According to the description, the vulnerability can be triggered by a crafted protobuf message without requiring authentication. Based on the information, the likely attack vector is untrusted protobuf input received over the network, which would cause the process to allocate excessive memory and crash locally. The EPSS score is < 1%, indicating a very low yet nonzero probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. While exploitation likelihood is low, an attacker could still cause a denial of service by exhausting memory in the affected process.