Add CVE-2026-55407 (buffa) and GHSA-j77w-g4jj-hp99 (gh-aw)

[p80n-sec]

Two records. The gh-aw one was added to this PR rather than a parallel branch because both regenerate the same README table region, which would have conflicted.

Record	Endor id	Project	CVSS	Reported	Disclosed
CVE-2026-55407	ENDOR-VUL-2026-2105	buffa / connectrpc < 0.8.0	6.3 (v4.0)	2026-05-21	2026-07-01
GHSA-j77w-g4jj-hp99	ENDOR-VUL-2026-0906	gh-aw <= 0.77.5	9.6 (v3.1)	2026-06-09	2026-08-07

CVE-2026-55407 — memory amplification DoS in buffa

Unbounded allocation in decode_unknown_field. Writeup added to links.yml. CWE-770, also tracked as CWE-400 and CWE-789. Fixed in 0.8.0 on 2026-06-25.

The record covers both sinks: the flagged LengthDelimited arm, where a wire-supplied length becomes the allocation size and the buf.remaining() guard bounds the read rather than the allocation (~2x), and the StartGroup arm one branch down, where checked_sub bounds recursion depth but nothing bounds field count — 2 wire bytes per ~40-byte UnknownField, so ~22x. A 64 MiB payload drives ~1.4 GB of heap and OOM-kills a 256 MiB-capped server (exit 137). DecodeOptions does not help: it caps input length, so it never sees a blow-up that starts small and expands during decode.

GHSA-j77w-g4jj-hp99 — command injection in gh-aw compiled workflows

gh aw compile writes sandbox.mcp.env values into the generated .lock.yml through an unescaped fmt.Fprintf(... "export %s=%s" ...), so a value carrying ;, $(...), a backtick, or a newline lands in command position inside a run: block. The adjacent export ten lines earlier already calls shellEscapeArg, which is what makes this a miss rather than a design choice, and nothing validates the source side either.

Severity comes from the trust boundary: gh-aw imports and packages workflow components from third-party repositories, so a malicious shared component executes with the job's GITHUB_TOKEN and secrets in the CI environment of every repository that imports it. Scope is Changed. Fixed in 0.86.0. No writeup or talk was published for this one, so blog and talks are absent.

Both are repository-level advisories

Neither GHSA-f9qc-qg88-7pq5 nor GHSA-j77w-g4jj-hp99 was promoted to the global GitHub Advisory Database — github.com/advisories/<id> returns 404 for both, and only the anthropics/buffa and github/gh-aw advisory pages resolve. They land differently:

• buffa is keyed on its CVE, so the identifier column links to NVD, which carries it. refs.ghsa records the repo URL for reference.
• gh-aw has no CVE, so it is keyed on the GHSA. This is exactly the case advisory_url was added for: without the refs.ghsa override the identifier would link to a 404 in both the README and the detail page. Verified that both now point at github.com/github/gh-aw/security/advisories/….

Credits and talks

Both credit Peyton Kennedy alone, which each advisory supports directly — p80n-sec is the sole finder on buffa and the sole reporter on gh-aw. Neither carries a talk.

Verification

.venv/bin/python -m pytest -q                                   # 179 passed
.venv/bin/python -m tools.generate --today 2026-08-24
.venv/bin/python -m tools.generate --check --today 2026-08-24   # exit 0

28 records render, both pages build, both identifiers resolve, and the Rust, Go, and YAML snippets render as real code blocks.

🤖 Generated with Claude Code