PT-2025-9522 · Abacus · Abacus

Jasonlovesdoggo · Published 2025-03-03 · Updated 2025-03-13 · CVE-2025-27421

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Abacus versions prior to 1.4.0

Description A critical issue has been identified in the Abacus server's Server-Sent Events (SSE) implementation, specifically with the /stream endpoint. When clients disconnect, the server fails to properly clean up resources and terminate associated goroutines, leading to resource exhaustion. The server continues running but eventually stops accepting new SSE connections while maintaining high memory usage. The issue involves improper channel cleanup in the event handling mechanism, causing goroutines to remain blocked indefinitely.

Recommendations For versions prior to 1.4.0, update to version 1.4.0 to resolve the issue. As a temporary workaround, consider restricting access to the /stream endpoint to minimize the risk of exploitation.

Exploit

Fix

Missing Release of Resource after Effective Lifetime

Resource Exhaustion

Weakness Enumeration

CWE-772

CWE-400

Related Identifiers

CVE-2025-27421

GHSA-VH64-54PX-QGF8

GO-2025-3498

OPENSUSE-SU-2025:14889-1

Affected Products

Abacus

References · 45

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/27xxx/CVE-2025-27421.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-27421 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:14889-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-27421 · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-3498 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-vh64-54px-qgf8 · Vendor Advisory
• https://github.com/JasonLovesDoggo/abacus/security/advisories/GHSA-vh64-54px-qgf8 · Note
• https://github.com/JasonLovesDoggo/abacus/commit/898ff1204e11317cc161240b660e63eed5a72b33 · Note
• https://github.com/JasonLovesDoggo/abacus/commit/78fdb9b48b7f6d08ed0cd41077509c0a97071552 · Note
• https://github.com/JasonLovesDoggo/abacus · Note
• https://suse.com/security/cve/CVE-2025-25294 · Note
• https://suse.com/security/cve/CVE-2024-57603 · Note
• https://suse.com/security/cve/CVE-2025-27155 · Note
• https://suse.com/security/cve/CVE-2025-27090 · Note
• https://suse.com/security/cve/CVE-2025-1293 · Note