https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 07:04:24 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-220233 EUVD-2026-220233 https://cve.radiocsirt.org/vuln/euvd-2026-220233 https://cve.radiocsirt.org/vuln/fkie_cve-2025-27421 <p>Abacus is a highly scalable and stateless counting API. A critical goroutine leak vulnerability has been identified in the Abacus server&#39;s Server-Sent Events (SSE) implementation. The issue occurs when clients disconnect from the /stream endpoint, as the server fails to properly clean up resources and terminate associated goroutines. This leads to resource exhaustion where the server continues running but eventually stops accepting new SSE connections while maintaining high memory usage. The vulnerability specifically involves improper channel cleanup in the event handling mechanism, causing goroutines to remain blocked indefinitely. This vulnerability is fixed in 1.4.0.</p> <p>Abacus is a highly scalable and stateless counting API. A critical goroutine leak vulnerability has been identified in the Abacus server&#39;s Server-Sent Events (SSE) implementation. The issue occurs when clients disconnect from the /stream endpoint, as the server fails to properly clean up resources and terminate associated goroutines. This leads to resource exhaustion where the server continues running but eventually stops accepting new SSE connections while maintaining high memory usage. The vulnerability specifically involves improper channel cleanup in the event handling mechanism, causing goroutines to remain blocked indefinitely. This vulnerability is fixed in 1.4.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-27421 https://cve.radiocsirt.org/vuln/ghsa-vh64-54px-qgf8 <p><strong>Affected:</strong> Go: github.com/jasonlovesdoggo/abacus</p> <p>## Goroutine Leak in Abacus SSE Implementation</p> <p>### Summary</p> <p>A critical goroutine leak vulnerability has been identified in the Abacus server&#39;s Server-Sent Events (SSE) implementation. The issue occurs when clients disconnect from the `/stream` endpoint, as the server fails to properly clean up resources and terminate associated goroutines. This leads to resource exhaustion where the server continues running but eventually stops accepting new SSE connections while maintaining high memory usage. The vulnerability specifically involves improper channel cleanup in the event handling mechanism, causing goroutines to remain blocked indefinitely.</p> <p>### [POC](https://github.com/JasonLovesDoggo/abacus/blob/main/docs/bugs/GHSA-vh64-54px-qgf8/test.py)</p> <p>### Impact</p> <p>This vulnerability affects all versions of Abacus prior to v1.4.0. The issue causes:</p> <p>- Permanent unresponsiveness of the `/stream` endpoint after prolonged use - Memory growth that stabilizes at a high level but prevents proper functionality - Selective denial of service affecting only SSE connections while other endpoints remain functional - Accumulated orphaned goroutines that cannot be garbage collected - High resource consumption under sustained client connection/disconnection patterns</p> <p>Systems running Abacus in production with client applications that frequently establish and terminate SSE connections are most vulnerable. The issue becomes particularly apparent in high-traffic environments or during connection stress te…</p> <p><strong>Affected:</strong> Go: github.com/jasonlovesdoggo/abacus</p> <p>## Goroutine Leak in Abacus SSE Implementation</p> <p>### Summary</p> <p>A critical goroutine leak vulnerability has been identified in the Abacus server&#39;s Server-Sent Events (SSE) implementation. The issue occurs when clients disconnect from the `/stream` endpoint, as the server fails to properly clean up resources and terminate associated goroutines. This leads to resource exhaustion where the server continues running but eventually stops accepting new SSE connections while maintaining high memory usage. The vulnerability specifically involves improper channel cleanup in the event handling mechanism, causing goroutines to remain blocked indefinitely.</p> <p>### [POC](https://github.com/JasonLovesDoggo/abacus/blob/main/docs/bugs/GHSA-vh64-54px-qgf8/test.py)</p> <p>### Impact</p> <p>This vulnerability affects all versions of Abacus prior to v1.4.0. The issue causes:</p> <p>- Permanent unresponsiveness of the `/stream` endpoint after prolonged use - Memory growth that stabilizes at a high level but prevents proper functionality - Selective denial of service affecting only SSE connections while other endpoints remain functional - Accumulated orphaned goroutines that cannot be garbage collected - High resource consumption under sustained client connection/disconnection patterns</p> <p>Systems running Abacus in production with client applications that frequently establish and terminate SSE connections are most vulnerable. The issue becomes particularly apparent in high-traffic environments or during connection stress te…</p> https://cve.radiocsirt.org/vuln/ghsa-vh64-54px-qgf8 https://cve.radiocsirt.org/vuln/opensuse-su-2025:14889-1 <p>govulncheck-vulndb-0.0.20250312T181707-1.1 on GA media</p> <p>govulncheck-vulndb-0.0.20250312T181707-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:14889-1