a2a-go vulnerabilities

A vulnerability was identified in a2aproject a2a-go up to 2.4.0 in the Cancel function of internal/taskexec/distributed_manager.go of the Distributed Manager component. Manipulation leads to denial of service, and the attack can be launched remotely.

A vulnerability was determined in a2aproject a2a-go up to 2.4.0 in an unknown function of a2asrv/rest.go of the REST SSE handler component. Manipulation causes resource consumption, and the attack can be initiated remotely.

A vulnerability was detected in a2a-go up to 2.4.0 affecting the CreateExecutor function in a2asrv/agentexec.go of the Push Notification Handler component. The manipulation results in information exposure through error messages. The attack can be launched remotely, and upgrading to version 2.5.0 mitigates the issue.