Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
anthropics/buffa
main @ 0358564
14
Fixes
0
CVEs
HIGH
Peak severity
30.8%
Coverage
Highlights
Denial of Service: 10 prior fixes. Scrutinize any change in this area.
buffa-codegen/src/impl_message.rs: most-fixed (3 issues). Treat as high-risk during review.
12 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Denial of Service: Multiple fixes target unbounded memory allocation in generated message decoders, with bypasses in packed closed-enum unknown fields and missing element budgets.
Denial of Service: Encoding size computation and reader limits had integer overflows that could corrupt output or cause panics; unknown field allocation was unbounded.
Denial of Service: Reflective decode lacked element-memory accounting, allowing unbounded memory growth from crafted inputs.