DoS vulnerability in Anthropic's protobuf library causes 22x memory amplification
An Endor Labs researcher identified CVE-2026-55407 in buffa, Anthropic's Rust library for protobuf. The unknown field decoder allocates memory proportional to the input. While typical cases see 2x amplification, the group processing branch reaches 22x.
A 64 MiB payload of empty varints expands to 1.4 GB on the heap. In a proof of concept, a server with a 256 MiB limit triggers an OOM-kill. The vulnerability is exploitable via default APIs when preserve_unknown_fields is set to true.
A fix is available in buffa and connectrpc 0.8.0, which introduces a limit of 1 million unknown fields per message. Anthropic assigned a CVSS 4.0 score of 6.3 (Moderate) and issued a $600 bug bounty.
Related stories
- Anthropic will bill again for requests its safeguards block
- Anthropic's 225 bug finds, one attack in the wild
- Fable 5.1 refuses the knife but heats a gas can anyway
- Claude Fable knocked 20 bits off most popular hashes
- Insiders say Anthropic oversold the rogue AI scare
- Gemini broke into three company systems during testing
Comments
No comments yet. Be the first.
Join the conversation
Sign in with Google to leave a comment. Your name and avatar come from your Google profile, and the comment appears after moderation.