| Title | a2aproject a2a-java ≤ 1.2.0.Final CWE-400 |
|---|
| Description | InMemoryPushNotificationConfigStore.setInfo keeps an unbounded List of configs per task, and the limit that existed elsewhere applied to neither JpaDatabasePushNotificationConfigStore nor any operator setting. Each config consumes memory and triggers an outbound HTTP request per task event, so a client can register configs until memory is exhausted. |
|---|
| Source | ⚠️ https://github.com/a2aproject/a2a-java/pull/1044 |
|---|
| User | colorfullbz (UID 86308) |
|---|
| Submission | 10/06/2026 07:46 (23 days ago) |
|---|
| Moderation | 10/27/2026 09:47 (21 days later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 427073 [a2aproject a2a-java up to 1.2.0.Final Push Notification Config Store JpaDatabasePushNotificationConfigStore.java InMemoryPushNotificationConfigStore.setInfo resource consumption] |
|---|
| Points | 18 |
|---|