🟡 [MEDIUM] CB-014: Unbounded Event Deduplication Set #23

New issue

Open

opened 2026-02-20 08:50:04 +00:00 by Alpha · 0 comments

Alpha commented

2026-02-20 08:50:04 +00:00

Security Finding from Audit

Parent issue: #1

Severity

MEDIUM 🟡

CVSS Score

N/A

CWE

CWE-400 (Uncontrolled Resource Consumption)

Location

agent.py, handle_message(), lines 229–230

Description

The _processed_events set grows unbounded and is trimmed by discarding the first 500 entries when exceeding 1000.

This creates a brief window where previously processed events could be re-processed (replay attack), and the trimming is non-deterministic since Python sets are unordered.

Recommendation

Use an LRU cache with TTL (e.g., cachetools.TTLCache) or a time-windowed deduplication approach.

From: Cobot Whitebox Security Audit (February 14, 2026)
Finding ID: CB-014

## Security Finding from Audit > Parent issue: #1 ### Severity **MEDIUM** 🟡 ### CVSS Score N/A ### CWE CWE-400 (Uncontrolled Resource Consumption) ### Location `agent.py, handle_message(), lines 229–230` --- ### Description The `_processed_events` set grows unbounded and is trimmed by discarding the first 500 entries when exceeding 1000. This creates a brief window where previously processed events could be re-processed (replay attack), and the trimming is non-deterministic since Python sets are unordered. --- ### Recommendation Use an LRU cache with TTL (e.g., `cachetools.TTLCache`) or a time-windowed deduplication approach. --- *From: Cobot Whitebox Security Audit (February 14, 2026)* *Finding ID: CB-014*