| शीर्षक | a2aproject a2a-go ≤ v2.4.0 CWE-404 |
|---|
| विवरण | In internal/taskexec/distributed_manager.go, after distributedManager.Cancel creates a reader via CreateReader, every early return - context encoding failure, task-store reload error, and the already-canceled or terminal branches - returns without closing it, leaking the reader and its registration on each cancel. Repeated cancellations of tasks that hit these branches accumulate leaked readers and registrations without bound, so an unauthenticated or low-privileged caller can steadily consume server resources by issuing cancels, degrading or eventually exhausting the service. |
|---|
| स्रोत | ⚠️ https://github.com/a2aproject/a2a-go/pull/409 |
|---|
| उपयोगकर्ता | colorfullbz (UID 86308) |
|---|
| सबमिशन | 06/10/2026 07:43 AM (22 दिन पहले) |
|---|
| संयम | 27/10/2026 09:47 AM (21 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 427071 [a2aproject a2a-go तक 2.4.0 Distributed Manager distributed_manager.go Cancel सेवा अस्वीकार] |
|---|
| अंक | 20 |
|---|