| Título | a2aproject a2a-java ≤ 1.2.0.Final CWE-400 |
|---|
| Descripción | InMemoryPushNotificationConfigStore.setInfo keeps an unbounded List of configs per task, and the limit that existed elsewhere applied to neither JpaDatabasePushNotificationConfigStore nor any operator setting. Each config consumes memory and triggers an outbound HTTP request per task event, so a client can register configs until memory is exhausted. |
|---|
| Fuente | ⚠️ https://github.com/a2aproject/a2a-java/pull/1044 |
|---|
| Usuario | colorfullbz (UID 86308) |
|---|
| Sumisión | 2026-10-06 07:46 (hace 21 días) |
|---|
| Moderación | 2026-10-27 09:47 (21 days later) |
|---|
| Estado | Aceptado |
|---|
| Entrada de VulDB | 427073 [a2aproject a2a-java hasta 1.2.0.Final Push Notification Config Store JpaDatabasePushNotificationConfigStore.java InMemoryPushNotificationConfigStore.setInfo denegación de servicio] |
|---|
| Puntos | 18 |
|---|