CVE-2026-55407

CVE-2026-55407 affects Buffa, a pure-Rust Protocol Buffers implementation. Before v0.8.0, decode_unknown_field could allocate unbounded heap in response to untrusted input, causing memory amplification (e.g., a 64 MiB input could trigger ~1.4 GB). This impacts messages decoded with preserve_unkno...