| Title | a2aproject a2a-java ≤ 1.2.0.Final CWE-400 |
|---|
| Description | ChildQueue builds a LinkedBlockingDeque without a capacity, so queue.offer() always returns true and the "queue is full" close path is dead code. A subscriber that stops consuming causes the deque to grow without limit while events keep being appended, and the queue is never closed. Because the growth is driven purely by the arrival of task events rather than by the subscriber, a single client that opens a subscription and then stops reading is enough to exhaust server memory over time, without needing concurrent requests or elevated privileges. |
|---|
| Source | ⚠️ https://github.com/a2aproject/a2a-java/pull/1040 |
|---|
| User | colorfullbz (UID 86308) |
|---|
| Submission | 10/06/2026 07:45 (24 days ago) |
|---|
| Moderation | 10/27/2026 09:47 (21 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 427072 [a2aproject a2a-java up to 1.2.0.Final ChildQueue queue.offer resource consumption] |
|---|
| Points | 20 |
|---|