AIKIDO-2024-10231

TL;DR

Affected versions of the package are vulnerable to memory leaks. When creating a subscription in ObjectStore.get, two long-running tasks—_hbtask for idle heartbeat and _fctask for ordered consumers—are created. These tasks are not cancelled when sub.unsubscribe() is called, causing them to continue running and holding references to the subscription and other objects. This prevents garbage collection, leading to a growing number of active coroutines (up to 20K observed) and resulting in increased memory usage and potential performance degradation.