PT-2025-9522 · Abacus · Abacus
Jasonlovesdoggo
·
Publicado
2025-03-03
·
Atualizado
2025-03-13
·
CVE-2025-27421
CVSS v3.1
7.5
Alta
| Vetor | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Name of the Vulnerable Software and Affected Versions
Abacus versions prior to 1.4.0
Description
A critical issue has been identified in the Abacus server's Server-Sent Events (SSE) implementation, specifically with the /stream endpoint. When clients disconnect, the server fails to properly clean up resources and terminate associated goroutines, leading to resource exhaustion. The server continues running but eventually stops accepting new SSE connections while maintaining high memory usage. The issue involves improper channel cleanup in the event handling mechanism, causing goroutines to remain blocked indefinitely.
Recommendations
For versions prior to 1.4.0, update to version 1.4.0 to resolve the issue. As a temporary workaround, consider restricting access to the /stream endpoint to minimize the risk of exploitation.
Exploit
Correção
Missing Release of Resource after Effective Lifetime
Resource Exhaustion
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Abacus