CVE-2026-55406Medium▾ SunlitBuffa has a Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 28.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.2%
A soundness bug in buffa's OwnedView<V> allowed safe Rust code to trigger a use-after-free. The OwnedView::decode constructor transmuted a borrowed slice to &'static [u8], and the Deref implementation exposed the promoted 'static lifetime on borrowed view fields (such as &'static str and &'static [u8]) to callers. Because these references appeared to be 'static, the borrow checker permitted them to outlive the OwnedView; once the OwnedView was dropped and its backing buffer freed, those references became dangling, enabling memory corruption, information disclosure of freed heap contents, and cross-thread misuse — all without any unsafe code in the calling application. Users are advised to update to the latest patched version of buffa.
Thank you to hackerone.com/suul for reporting this issue.
buffa < 0.7.0Upgrade to a patched release:
buffa 0.7.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-55407MediumBuffa Vulnerable to Memory Exhaustion Denial of Service in decode_unknown_field via Unbounded Allocation
CVE-2021-25122High· 7.5When responding to new h2c connection requests, Apache Tomcat versions 10.0.0-M1 to 10.0.0, 9.0.0.M1 to 9.0.41 and 8.5.0 to 8.5.61 could duplicate request headers and a limited amount of request body from one request to another meaning u…
CVE-2022-31746Medium· 6.5Internal URLs are protected by a secret UUID key, which could have been leaked to web page through the Referrer header
CVE-2026-49449Low· 2.5Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks
CVE-2026-1255High· 7.5The YS LeadGen plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.1.4 due to the 'ysleadgen_get_captured_data' AJAX action being accessible to unauthenticated users
CVE-2026-16557Medium· 4.3The Nimble Page Builder WordPress plugin through 3.3.8 does not perform an authorization check when returning page-builder content through an authenticated AJAX action, allowing any authenticated user (Subscriber+) to disclose the page-b…