CVE-2025-27421: 
vulnerability analysis and mitigation

CVE-2025-27421 affects Abacus, a highly scalable and stateless counting API. The vulnerability was discovered and disclosed on March 2, 2025, involving a critical goroutine leak in the Server-Sent Events (SSE) implementation. The issue occurs when clients disconnect from the /stream endpoint, where the server fails to properly clean up resources and terminate associated goroutines. This vulnerability affects all versions of Abacus prior to version 1.4.0 (GitHub Advisory, NVD).

The vulnerability specifically involves improper channel cleanup in the event handling mechanism, causing goroutines to remain blocked indefinitely. The issue has been assigned a CVSS v3.1 base score of 7.5 (High) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The vulnerability is categorized under CWE-400 (Uncontrolled Resource Consumption) and CWE-772 (Missing Release of Resource after Effective Lifetime) (GitHub Advisory).

The vulnerability leads to resource exhaustion where the server continues running but eventually stops accepting new SSE connections while maintaining high memory usage. The impact includes permanent unresponsiveness of the /stream endpoint after prolonged use, memory growth that stabilizes at a high level but prevents proper functionality, and accumulated orphaned goroutines that cannot be garbage collected. Systems running Abacus in production with client applications that frequently establish and terminate SSE connections are most vulnerable, particularly in high-traffic environments (GitHub Advisory).

The vulnerability has been patched in Abacus v1.4.0, which implements buffered channels, proper mutex-protected cleanup logic, timeout protection for channel operations, and improved monitoring for client disconnections. For users unable to upgrade immediately, recommended workarounds include limiting maximum connections through reverse proxy configuration, implementing request timeouts, scheduling regular service restarts, monitoring memory usage, and running a dedicated Abacus instance for SSE connections (GitHub Advisory).