{"action":"Upgrade buffa to 0.7.0 or later.","affected":[{"fixed":"0.7.0","introduced":"0"}],"component":"buffa","cve_ids":["CVE-2026-55406"],"ecosystem":"crates.io","epss":0.00193,"exploited":false,"fixed_versions":["0.7.0"],"ghsa_id":"GHSA-9pwq-gcrx-wghh","id":"tcs_01M5KEWH5Z4PA3E7C7J3HNPSRM","modified_at":"2026-08-28T18:45:07.623595565Z","published_at":"2026-08-28T18:33:58Z","references":["https://osv.dev/vulnerability/GHSA-9pwq-gcrx-wghh","https://github.com/anthropics/buffa/security/advisories/GHSA-9pwq-gcrx-wghh","https://nvd.nist.gov/vuln/detail/CVE-2026-55406","https://github.com/anthropics/buffa/pull/154","https://github.com/anthropics/buffa/commit/7dcf50a1a40eca6ed8d6c6dd59f4310aa0d68b0e","https://github.com/anthropics/buffa","https://github.com/anthropics/buffa/releases/tag/v0.7.0"],"severity":{"label":"medium","score":5.9},"sources":[{"source":"osv","source_id":"GHSA-9pwq-gcrx-wghh","url":"https://osv.dev/vulnerability/GHSA-9pwq-gcrx-wghh"},{"source":"nvd","source_id":"CVE-2026-55406","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55406"}],"summary":"Buffa has a Use-After-Free in OwnedView via Unsound 'static Lifetime Promotion in Deref"}