AIKIDO-2026-927111

TL;DR

The owned and view protobuf decoders in buffa materialize the elements of repeated fields and map entries without bounding the memory they consume. An attacker who supplies a small protobuf payload containing many empty repeated-message, string, bytes, or map elements can force decoding to allocate far more memory than the input size, because each element expands to its full in-memory footprint on decode. Before the fix the existing message-size limit bounded only the input bytes, not this in-decode amplification, so untrusted input could exhaust process memory. The fix adds a per-decode element-memory budget (DecodeOptions::with_element_memory_limit, default 32 MiB) that charges each materialized element and rejects over-budget input with DecodeError::ElementMemoryLimitExceeded.