| 标题 | a2aproject a2a-go ≤ v2.4.0 CWE-400 |
|---|
| 描述 | The REST SSE handler creates panicChan unbuffered, so a panic after the client disconnects is never read and the goroutine blocks forever on the send. A remote client can trigger this repeatedly by disconnecting while streaming, permanently consuming a goroutine and its stack each time, causing unbounded memory growth. |
|---|
| 来源 | ⚠️ https://github.com/a2aproject/a2a-go/pull/396 |
|---|
| 用户 | colorfullbz (UID 86308) |
|---|
| 提交 | 2026-10-06 07時39分 (22 日前) |
|---|
| 管理 | 2026-10-27 09時47分 (21 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 427070 [a2aproject a2a-go 直到 2.4.0 REST SSE handler a2asrv/rest.go 拒绝服务] |
|---|
| 积分 | 18 |
|---|