| Titel | a2aproject a2a-java ≤ 1.2.0.Final CWE-400 |
|---|
| Beschreibung | InMemoryPushNotificationConfigStore.setInfo keeps an unbounded List of configs per task, and the limit that existed elsewhere applied to neither JpaDatabasePushNotificationConfigStore nor any operator setting. Each config consumes memory and triggers an outbound HTTP request per task event, so a client can register configs until memory is exhausted. |
|---|
| Quelle | ⚠️ https://github.com/a2aproject/a2a-java/pull/1044 |
|---|
| Benutzer | colorfullbz (UID 86308) |
|---|
| Einreichung | 06.10.2026 07:46 (vor 22 Tagen) |
|---|
| Moderieren | 27.10.2026 09:47 (21 days later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 427073 [a2aproject a2a-java bis 1.2.0.Final Push Notification Config Store JpaDatabasePushNotificationConfigStore.java InMemoryPushNotificationConfigStore.setInfo Denial of Service] |
|---|
| Punkte | 18 |
|---|