anthropics Vulnerabilities and Affected Products
Vulnerabilities associated with buffa.
Products
Clear product- claude-code29 vulnerabilities
- anthropic-sdk-python2 vulnerabilities
- anthropic-sdk-typescript2 vulnerabilities
- buffa2 vulnerabilities
- claude-code-action1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-55407MEDIUM | Buffa: Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded AllocationBuffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.8.0, the decode_unknown_field function in buffa's protobuf decoder allocated heap memory in proportion to untrusted input (unknown fields in the serialized protobuf) without enforcing an allocation budget, affecting any message decoded from untrusted input using code generated with preserve_unknown_fields=true (the default); a small, well-formed payload of nested unknown fields inside a St… | CVSS6.3v4.0 | EPSS0.423% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2026-55406MEDIUM | Buffa: Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in DerefBuffa is a pure-Rust Protocol Buffers implementation with first-class protobuf editions support. Prior to 0.7.0, a soundness bug in the OwnedView<V> type allowed safe Rust code to trigger a use-after-free: the OwnedView::decode constructor transmuted a borrowed slice to &'static [u8], and the Deref implementation exposed the promoted 'static lifetime on borrowed view fields (such as &'static str and &'static [u8]) to callers, so the borrow checker permitted those references to outlive the OwnedV… | CVSS5.9v4.0 | EPSS0.128% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |