| Название | a2aproject a2a-java ≤ 1.2.0.Final CWE-400 |
|---|
| Описание | ChildQueue builds a LinkedBlockingDeque without a capacity, so queue.offer() always returns true and the "queue is full" close path is dead code. A subscriber that stops consuming causes the deque to grow without limit while events keep being appended, and the queue is never closed. Because the growth is driven purely by the arrival of task events rather than by the subscriber, a single client that opens a subscription and then stops reading is enough to exhaust server memory over time, without needing concurrent requests or elevated privileges. |
|---|
| Источник | ⚠️ https://github.com/a2aproject/a2a-java/pull/1040 |
|---|
| Пользователь | colorfullbz (UID 86308) |
|---|
| Представление | 06.10.2026 07:45 (21 дни назад) |
|---|
| Модерация | 27.10.2026 09:47 (21 days later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 427072 [a2aproject a2a-java до 1.2.0.Final ChildQueue queue.offer отказ в обслуживании] |
|---|
| Баллы | 20 |
|---|