Anthropic’s Rust-based protobuf library, buffa, has been discovered to have a zero-day memory amplification denial-of-service (DoS) vulnerability. This flaw allows attackers to deplete system memory using relatively small inputs.
Endor Labs identified the issue through its AI-powered static application security testing (SAST) engine and is now tracked as CVE-2026-55407. This situation underscores how logic flaws in memory-safe programming languages can still result in significant resource exhaustion.
Anthropic buffa Library Zero-Day
The vulnerability resides in buffa’s unknown-field decoding logic, specifically within the decode_unknown_field function. While Rust inherently prevents memory corruption, it does not guard against uncontrolled resource allocation.
In this case, attacker-controlled input directly influences heap allocation size, enabling adversaries to trigger excessive memory consumption. The flaw affects all versions before 0.8.0 when decoding untrusted protobuf messages with the default setting preserve_unknown_fields=true.
Endor Labs’ AI SAST engine initially flagged a data flow in which a length value parsed from untrusted wire data was used to allocate a vector without an upper bound.
This “flat allocation” path results in memory usage roughly twice the size of the input, which alone could be problematic under constrained environments. However, deeper analysis uncovered a more severe amplification vector within the handling of protobuf “StartGroup” fields.
In this second execution path, the decoder processes nested unknown fields in a loop, appending each parsed field into a dynamically growing vector. Each minimal input element, just 2 bytes representing a varint, results in approximately 40 bytes of heap allocation. This creates a memory amplification factor of nearly 22x.
For example, a crafted 64 MB payload can force the application to allocate roughly 1.4 GB of memory, leading to out-of-memory (OOM) termination even in moderately provisioned environments.
Notably, the attack does not require bypassing input size limits. Traditional mitigations, such as restricting request size, are ineffective because amplification occurs during decoding.
Even with a standard 4 MB gRPC message cap, concurrent malicious requests can rapidly exhaust memory. This makes the vulnerability particularly dangerous in high-concurrency services, file ingestion pipelines, or systems without strict runtime memory controls.
The vulnerable code path is reachable through default decoding APIs such as Message::decode and decode_from_slice, meaning exploitation does not require specialized conditions.
Any service that processes untrusted protobuf input using buffa is potentially at risk. A proof-of-concept developed by researchers demonstrated reliable OOM crashes in containerized environments, with processes terminated under memory limits as low as 256 MB.
Anthropic responded promptly to the disclosure, collaborating with researchers to validate the issue and assess its impact across deployment scenarios.
While the vulnerability received a CVSS v4.0 score of 6.3 (Moderate), researchers argue that real-world severity can range from medium to critical depending on system architecture, concurrency, and recovery mechanisms.
In poorly supervised or single-instance deployments, repeated exploitation can lead to persistent crash loops and sustained service outages.
The issue has been patched in buffa and connectrpc version 0.8.0. The fix introduces a configurable cap on the number of unknown fields processed per message, effectively limiting memory growth.
By default, this cap restricts allocation overhead to approximately 40 MB per message. Developers unable to upgrade immediately are advised to regenerate the protobuf code with preserve_unknown_fields=false, which disables the vulnerable code path entirely.
This vulnerability underscores a broader security lesson: memory safety does not equate to resource safety. Even in languages like Rust, unbounded allocation logic can introduce denial-of-service risks when processing untrusted data.
The discovery also demonstrates the growing role of AI-driven security tools in identifying complex, multi-stage data flow vulnerabilities that traditional static analysis might overlook.
Interact with Cyber Threats in Windows, Linux, macOS VMs to Trigger Full Attack Chain - Analyse Malware & Phishing with ANY RUN
 vulnerability.){kind=link}