CVE-2025-27421CWE-400CWE-772

Goroutine Leak in Abacus SSE Implementation

High · published March 3, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
34.4
In the wild
Unconfirmed
What it is

Abacus is a highly scalable and stateless counting API. A critical goroutine leak vulnerability has been identified in the Abacus server's Server-Sent Events (SSE) implementation. The issue occurs when clients disconnect from the /stream endpoint, as the server fails to properly clean up resources and terminate associated goroutines. This leads to resource exhaustion where the server continues running but eventually stops accepting new SSE connections while maintaining high memory usage. The vulnerability specifically involves improper channel cleanup in the event handling mechanism, causing goroutines to remain blocked indefinitely. This vulnerability is fixed in 1.4.0.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00413 · 34.4th percentile
Weaknesses
CWE-400 · Uncontrolled Resource Consumption; CWE-772 · Missing Release of Resource after Effective Lifetime
Published
2025-03-03T16:19Z
EPSS history
Timeline
  • 03 MAR 16:19Z
    Goroutine Leak in Abacus SSE Implementation
    cvelistv5