🧰 buffa

The items that name it 3

• SAST for AI-Generated Code: What Static Analysis Catches and Misses | Blog | Endor Labs
  article2026-09-02

  Affected by CVE-2026-55407, discovered via Endor Labs AI SAST dataflow analysis

• Benchmarking Endor Labs AI SAST: 2.6x more real vulnerabilities found than frontier models | Blog | Endor Labs
  article2026-07-06It is written here as buffa (Anthropic's Rust protobuf library): unbounded heap allocation reachable from default decode APIs, ~22x memory blow-up and OOM-kill of the process (CVE-2026-55407).

  Anthropic's Rust protobuf library

• Endor Labs’ AI SAST Finds Zero Day Memory-Amplification DoS in Anthropic’s buffa library | Blog | Endor Labs
  writeup2026-07-06