| 제목 | a2aproject a2a-java ≤ 1.2.0.Final CWE-400 |
|---|
| 설명 | InMemoryPushNotificationConfigStore.setInfo keeps an unbounded List of configs per task, and the limit that existed elsewhere applied to neither JpaDatabasePushNotificationConfigStore nor any operator setting. Each config consumes memory and triggers an outbound HTTP request per task event, so a client can register configs until memory is exhausted. |
|---|
| 원천 | ⚠️ https://github.com/a2aproject/a2a-java/pull/1044 |
|---|
| 사용자 | colorfullbz (UID 86308) |
|---|
| 제출 | 2026. 10. 06. AM 07:46 (22 날 ago) |
|---|
| 모더레이션 | 2026. 10. 27. AM 09:47 (21 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 427073 [a2aproject a2a-java 까지 1.2.0.Final Push Notification Config Store JpaDatabasePushNotificationConfigStore.java InMemoryPushNotificationConfigStore.setInfo 서비스 거부] |
|---|
| 포인트들 | 18 |
|---|