x/vulndb: potential Go vuln in github.com/jasonlovesdoggo/abacus: GHSA-vh64-54px-qgf8

[GoVulnBot]

Advisory GHSA-vh64-54px-qgf8 references a vulnerability in the following Go modules:

Module
github.com/jasonlovesdoggo/abacus

Description:

Goroutine Leak in Abacus SSE Implementation

Summary

A critical goroutine leak vulnerability has been identified in the Abacus server's Server-Sent Events (SSE) implementation. The issue occurs when clients disconnect from the /stream endpoint, as the server fails to properly clean up resources and terminate associated goroutines. This leads to resource exhaustion where the server continues running but eventually stops accepting new SSE connections while maintaining high memory usage. The vulnerability specifically involves improper channel cleanup in the event handling mechanism, ca...

References:

• ADVISORY: GHSA-vh64-54px-qgf8
• ADVISORY: GHSA-vh64-54px-qgf8
• FIX: JasonLovesDoggo/abacus@78fdb9b
• FIX: JasonLovesDoggo/abacus@898ff12

No existing reports found with this module or alias.
See doc/quickstart.md for instructions on how to triage this report.

id: GO-ID-PENDING
modules:
    - module: github.com/jasonlovesdoggo/abacus
      versions:
        - fixed: 0.0.0-20250302043802-898ff1204e11
summary: Goroutine Leak in Abacus SSE Implementation in github.com/jasonlovesdoggo/abacus
cves:
    - CVE-2025-27421
ghsas:
    - GHSA-vh64-54px-qgf8
references:
    - advisory: https://github.com/JasonLovesDoggo/abacus/security/advisories/GHSA-vh64-54px-qgf8
    - advisory: https://github.com/advisories/GHSA-vh64-54px-qgf8
    - fix: https://github.com/JasonLovesDoggo/abacus/commit/78fdb9b48b7f6d08ed0cd41077509c0a97071552
    - fix: https://github.com/JasonLovesDoggo/abacus/commit/898ff1204e11317cc161240b660e63eed5a72b33
notes:
    - fix: 'github.com/jasonlovesdoggo/abacus: could not add vulnerable_at: cannot auto-guess when fixed version is 0.0.0 pseudo-version'
source:
    id: GHSA-vh64-54px-qgf8
    created: 2025-03-03T17:01:57.504183988Z
review_status: UNREVIEWED

[gopherbot]

Change https://go.dev/cl/655095 mentions this issue: data/reports: add 4 reports