buffa
Rust implementation of protobuf with editions support, JSON serialization, and zero-copy views
View on Github
Activity
- Latest release
- 1w ago
- Total releases
- 15
- Cadence
- ~10 days
- Last 12 months
- 15
Reach
- Downloads
- 6.7M
- Stars
- 881
Details
- License
- Apache-2.0
- First release
- Mar 14, 2026
| Version | Released | |
|---|---|---|
0.9.2
patch
| ||
0.9.1
unknown
| ||
0.9.0
unknown
| ||
0.8.1
unknown
| ||
0.8.0
unknown
| ||
0.7.1
unknown
1 CVE
CVE-2026-55407
GHSA-f9qc-qg88-7pq5
Aug 28, 2026
Buffa Vulnerable to Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded Allocation
Medium
Network
Low
None
None
The For users of connectrpc - the DEFAULT_MAX_MESSAGE_SIZE for connectrpc is 4MiB, which limits amplification in the worst case to ~88 MiB of memory. A flood of concurrent requests with this pattern could still be used to exhaust available memory, however. Users are advised to either set Thank you to @p80n-sec for reporting this issue. Fixed in
0.8.0
References
Updated Aug 28, 2026 · Source: OSV.dev | ||
0.7.0
unknown
1 CVE
CVE-2026-55407
GHSA-f9qc-qg88-7pq5
Aug 28, 2026
Buffa Vulnerable to Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded Allocation
Medium
Network
Low
None
None
The For users of connectrpc - the DEFAULT_MAX_MESSAGE_SIZE for connectrpc is 4MiB, which limits amplification in the worst case to ~88 MiB of memory. A flood of concurrent requests with this pattern could still be used to exhaust available memory, however. Users are advised to either set Thank you to @p80n-sec for reporting this issue. Fixed in
0.8.0
References
Updated Aug 28, 2026 · Source: OSV.dev | ||
0.6.0
unknown
2 CVEs
CVE-2026-55407
GHSA-f9qc-qg88-7pq5
Aug 28, 2026
Buffa Vulnerable to Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded Allocation
Medium
Network
Low
None
None
The For users of connectrpc - the DEFAULT_MAX_MESSAGE_SIZE for connectrpc is 4MiB, which limits amplification in the worst case to ~88 MiB of memory. A flood of concurrent requests with this pattern could still be used to exhaust available memory, however. Users are advised to either set Thank you to @p80n-sec for reporting this issue. Fixed in
0.8.0
References
Updated Aug 28, 2026 · Source: OSV.dev
CVE-2026-55406
GHSA-9pwq-gcrx-wghh
Aug 28, 2026
Buffa has a Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref
Medium
Local
High
None
None
A soundness bug in Thank you to hackerone.com/suul for reporting this issue. Fixed in
0.7.0
References
Updated Aug 28, 2026 · Source: OSV.dev | ||
0.5.2
unknown
2 CVEs
CVE-2026-55407
GHSA-f9qc-qg88-7pq5
Aug 28, 2026
Buffa Vulnerable to Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded Allocation
Medium
Network
Low
None
None
The For users of connectrpc - the DEFAULT_MAX_MESSAGE_SIZE for connectrpc is 4MiB, which limits amplification in the worst case to ~88 MiB of memory. A flood of concurrent requests with this pattern could still be used to exhaust available memory, however. Users are advised to either set Thank you to @p80n-sec for reporting this issue. Fixed in
0.8.0
References
Updated Aug 28, 2026 · Source: OSV.dev
CVE-2026-55406
GHSA-9pwq-gcrx-wghh
Aug 28, 2026
Buffa has a Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref
Medium
Local
High
None
None
A soundness bug in Thank you to hackerone.com/suul for reporting this issue. Fixed in
0.7.0
References
Updated Aug 28, 2026 · Source: OSV.dev | ||
0.5.1
unknown
2 CVEs
CVE-2026-55407
GHSA-f9qc-qg88-7pq5
Aug 28, 2026
Buffa Vulnerable to Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded Allocation
Medium
Network
Low
None
None
The For users of connectrpc - the DEFAULT_MAX_MESSAGE_SIZE for connectrpc is 4MiB, which limits amplification in the worst case to ~88 MiB of memory. A flood of concurrent requests with this pattern could still be used to exhaust available memory, however. Users are advised to either set Thank you to @p80n-sec for reporting this issue. Fixed in
0.8.0
References
Updated Aug 28, 2026 · Source: OSV.dev
CVE-2026-55406
GHSA-9pwq-gcrx-wghh
Aug 28, 2026
Buffa has a Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref
Medium
Local
High
None
None
A soundness bug in Thank you to hackerone.com/suul for reporting this issue. Fixed in
0.7.0
References
Updated Aug 28, 2026 · Source: OSV.dev | ||
0.5.0
unknown
2 CVEs
CVE-2026-55407
GHSA-f9qc-qg88-7pq5
Aug 28, 2026
Buffa Vulnerable to Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded Allocation
Medium
Network
Low
None
None
The For users of connectrpc - the DEFAULT_MAX_MESSAGE_SIZE for connectrpc is 4MiB, which limits amplification in the worst case to ~88 MiB of memory. A flood of concurrent requests with this pattern could still be used to exhaust available memory, however. Users are advised to either set Thank you to @p80n-sec for reporting this issue. Fixed in
0.8.0
References
Updated Aug 28, 2026 · Source: OSV.dev
CVE-2026-55406
GHSA-9pwq-gcrx-wghh
Aug 28, 2026
Buffa has a Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref
Medium
Local
High
None
None
A soundness bug in Thank you to hackerone.com/suul for reporting this issue. Fixed in
0.7.0
References
Updated Aug 28, 2026 · Source: OSV.dev | ||
0.4.0
unknown
2 CVEs
CVE-2026-55407
GHSA-f9qc-qg88-7pq5
Aug 28, 2026
Buffa Vulnerable to Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded Allocation
Medium
Network
Low
None
None
The For users of connectrpc - the DEFAULT_MAX_MESSAGE_SIZE for connectrpc is 4MiB, which limits amplification in the worst case to ~88 MiB of memory. A flood of concurrent requests with this pattern could still be used to exhaust available memory, however. Users are advised to either set Thank you to @p80n-sec for reporting this issue. Fixed in
0.8.0
References
Updated Aug 28, 2026 · Source: OSV.dev
CVE-2026-55406
GHSA-9pwq-gcrx-wghh
Aug 28, 2026
Buffa has a Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref
Medium
Local
High
None
None
A soundness bug in Thank you to hackerone.com/suul for reporting this issue. Fixed in
0.7.0
References
Updated Aug 28, 2026 · Source: OSV.dev | ||
0.3.0
unknown
2 CVEs
CVE-2026-55407
GHSA-f9qc-qg88-7pq5
Aug 28, 2026
Buffa Vulnerable to Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded Allocation
Medium
Network
Low
None
None
The For users of connectrpc - the DEFAULT_MAX_MESSAGE_SIZE for connectrpc is 4MiB, which limits amplification in the worst case to ~88 MiB of memory. A flood of concurrent requests with this pattern could still be used to exhaust available memory, however. Users are advised to either set Thank you to @p80n-sec for reporting this issue. Fixed in
0.8.0
References
Updated Aug 28, 2026 · Source: OSV.dev
CVE-2026-55406
GHSA-9pwq-gcrx-wghh
Aug 28, 2026
Buffa has a Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref
Medium
Local
High
None
None
A soundness bug in Thank you to hackerone.com/suul for reporting this issue. Fixed in
0.7.0
References
Updated Aug 28, 2026 · Source: OSV.dev | ||
0.2.0
unknown
2 CVEs
CVE-2026-55407
GHSA-f9qc-qg88-7pq5
Aug 28, 2026
Buffa Vulnerable to Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded Allocation
Medium
Network
Low
None
None
The For users of connectrpc - the DEFAULT_MAX_MESSAGE_SIZE for connectrpc is 4MiB, which limits amplification in the worst case to ~88 MiB of memory. A flood of concurrent requests with this pattern could still be used to exhaust available memory, however. Users are advised to either set Thank you to @p80n-sec for reporting this issue. Fixed in
0.8.0
References
Updated Aug 28, 2026 · Source: OSV.dev
CVE-2026-55406
GHSA-9pwq-gcrx-wghh
Aug 28, 2026
Buffa has a Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref
Medium
Local
High
None
None
A soundness bug in Thank you to hackerone.com/suul for reporting this issue. Fixed in
0.7.0
References
Updated Aug 28, 2026 · Source: OSV.dev | ||
0.1.0
unknown
2 CVEs
CVE-2026-55407
GHSA-f9qc-qg88-7pq5
Aug 28, 2026
Buffa Vulnerable to Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded Allocation
Medium
Network
Low
None
None
The For users of connectrpc - the DEFAULT_MAX_MESSAGE_SIZE for connectrpc is 4MiB, which limits amplification in the worst case to ~88 MiB of memory. A flood of concurrent requests with this pattern could still be used to exhaust available memory, however. Users are advised to either set Thank you to @p80n-sec for reporting this issue. Fixed in
0.8.0
References
Updated Aug 28, 2026 · Source: OSV.dev
CVE-2026-55406
GHSA-9pwq-gcrx-wghh
Aug 28, 2026
Buffa has a Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref
Medium
Local
High
None
None
A soundness bug in Thank you to hackerone.com/suul for reporting this issue. Fixed in
0.7.0
References
Updated Aug 28, 2026 · Source: OSV.dev |