CVE-2026-117503
MediumCVSS 5.3Exploitation Probability (EPSS)
Elevated risk54th percentile - higher than 54% of all known CVEs
Summary
A vulnerability was determined in a2aproject a2a-go up to 2.4.0 in an unknown function of a2asrv/rest.go of the REST SSE handler component. Manipulation causes resource consumption, and the attack can be initiated remotely.
Risk Assessment
An attacker can remotely cause resource exhaustion, potentially disrupting services using a2a-go. This may affect system availability.
Recommendation
Upgrade a2a-go to version 2.5.0 or later, which contains the fix. Until then, consider monitoring and limiting resource consumption by vulnerable functions.
Other vulnerabilities in a2a-go
See all- CVE-2026-117504Medium
A vulnerability was identified in a2aproject a2a-go up to 2.4.0 in the Cancel function of internal/taskexec/distributed_manager.go of the Distributed Manager component. Manipulation leads to denial of service, and the attack can be launched remotely.
- CVE-2026-116478Medium
A vulnerability was detected in a2a-go up to 2.4.0 affecting the CreateExecutor function in a2asrv/agentexec.go of the Push Notification Handler component. The manipulation results in information exposure through error messages. The attack can be launched remotely, and upgrading to version 2.5.0 mitigates the issue.
Original NVD description (English source)
A vulnerability was determined in a2aproject a2a-go up to 2.4.0. Impacted is an unknown function of the file a2asrv/rest.go of the component REST SSE handler. This manipulation causes resource consumption. It is possible to initiate the attack remotely. Upgrading to version 2.5.0 is recommended to address this issue. Patch name: ff6035bd21e44bb3ee1bfa547885b8c08327fa01. It is recommended to upgrade the affected component.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS