GHSA-9pwq-gcrx-wghh: Infoleak

Published Aug 28, 2026
·
Updated

A soundness bug in buffa's OwnedView<V> allowed safe Rust code to trigger a use-after-free. The OwnedView::decode constructor transmuted a borrowed slice to &'static [u8], and the Deref implementation exposed the promoted 'static lifetime on borrowed view fields (such as &'static str and &'static [u8]) to callers. Because these references appeared to be 'static, the borrow checker permitted them to outlive the OwnedView; once the OwnedView was dropped and its backing buffer freed, those references became dangling, enabling memory corruption, information disclosure of freed heap contents, and cross-thread misuse — all without any unsafe code in the calling application. Users are advised to update to the latest patched version of buffa.

Thank you to hackerone.com/suul for reporting this issue.

Affected Software

1 affected componentFixes available
rust/buffa<0.7.0
0.7.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade rust/buffa to a version that resolves this vulnerability.

    Fixed in 0.7.0

Event History

Aug 28, 2026
Advisory Published
via GitHub·06:33 PM
Data Sourced
via GitHub·06:33 PM
DescriptionWeaknessAffected Software

Frequently Asked Questions

1

Which applications are exposed to this issue?

Applications using buffa's OwnedView::decode are exposed if they retain borrowed view fields such as &str or &[u8] beyond the lifetime of the OwnedView that backs them. The issue can be triggered from safe Rust code in the calling application.

2

What can result from successful exploitation?

Dangling references can be used after the OwnedView is dropped and its backing buffer is freed. The reported impacts include memory corruption, disclosure of freed heap contents, and cross-thread misuse.

3

What should teams do to remediate the issue?

Update buffa to the latest patched version. The provided information does not identify an alternative mitigation for deployments that cannot update immediately.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203