| Titel | a2aproject a2a-java ≤ 1.2.0.Final CWE-400 |
|---|
| Beschreibung | ChildQueue builds a LinkedBlockingDeque without a capacity, so queue.offer() always returns true and the "queue is full" close path is dead code. A subscriber that stops consuming causes the deque to grow without limit while events keep being appended, and the queue is never closed. Because the growth is driven purely by the arrival of task events rather than by the subscriber, a single client that opens a subscription and then stops reading is enough to exhaust server memory over time, without needing concurrent requests or elevated privileges. |
|---|
| Quelle | ⚠️ https://github.com/a2aproject/a2a-java/pull/1040 |
|---|
| Benutzer | colorfullbz (UID 86308) |
|---|
| Einreichung | 06.10.2026 07:45 (vor 22 Tagen) |
|---|
| Moderieren | 27.10.2026 09:47 (21 days later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 427072 [a2aproject a2a-java bis 1.2.0.Final ChildQueue queue.offer Denial of Service] |
|---|
| Punkte | 20 |
|---|