Search
Find a vulnerability
Search criteria
6 vulnerabilities found for a2a-go by a2aproject
CVE-2026-117504 (GCVE-0-2026-117504)
Vulnerability from nvd – Published: 2026-10-27 14:00 – Updated: 2026-10-27 14:00 X_Open Source
VLAI
EPSS
VEX
Title
a2aproject a2a-go Distributed Manager distributed_manager.go Cancel denial of service
Summary
A vulnerability was identified in a2aproject a2a-go up to 2.4.0. The affected element is the function Cancel of the file internal/taskexec/distributed_manager.go of the component Distributed Manager. Such manipulation leads to denial of service. It is possible to launch the attack remotely. Upgrading to version 2.5.0 is sufficient to fix this issue. The name of the patch is 14e41a978b31e134ffa1170d8657f9dd98529aa3. Upgrading the affected component is advised.
Severity
CWE
- CWE-404 - Denial of Service
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/427071 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/427071/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-117504 | third-party-advisory |
| https://vuldb.com/submit/1015053 | third-party-advisory |
| https://github.com/a2aproject/a2a-go/pull/409 | issue-trackingpatch |
| https://github.com/a2aproject/a2a-go/commit/14e41… | patch |
| https://github.com/a2aproject/a2a-go/releases/tag… | patch |
| https://github.com/a2aproject/a2a-go/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| a2aproject | a2a-go |
Affected:
2.0
Affected: 2.1 Affected: 2.2 Affected: 2.3 Affected: 2.4.0 Unaffected: 2.5.0 cpe:2.3:a:a2aproject:a2a-go:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:a2aproject:a2a-go:*:*:*:*:*:*:*:*"
],
"modules": [
"Distributed Manager"
],
"product": "a2a-go",
"vendor": "a2aproject",
"versions": [
{
"status": "affected",
"version": "2.0"
},
{
"status": "affected",
"version": "2.1"
},
{
"status": "affected",
"version": "2.2"
},
{
"status": "affected",
"version": "2.3"
},
{
"status": "affected",
"version": "2.4.0"
},
{
"status": "unaffected",
"version": "2.5.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "colorfullbz (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in a2aproject a2a-go up to 2.4.0. The affected element is the function Cancel of the file internal/taskexec/distributed_manager.go of the component Distributed Manager. Such manipulation leads to denial of service. It is possible to launch the attack remotely. Upgrading to version 2.5.0 is sufficient to fix this issue. The name of the patch is 14e41a978b31e134ffa1170d8657f9dd98529aa3. Upgrading the affected component is advised."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-404",
"description": "Denial of Service",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T14:00:17.060Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-427071 | a2aproject a2a-go Distributed Manager distributed_manager.go Cancel denial of service",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/427071"
},
{
"name": "VDB-427071 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/427071/cti"
},
{
"name": "CVE-2026-117504 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-117504"
},
{
"name": "Submit #1015053 | a2aproject a2a-go \u2264 v2.4.0 CWE-404",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1015053"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/a2aproject/a2a-go/pull/409"
},
{
"tags": [
"patch"
],
"url": "https://github.com/a2aproject/a2a-go/commit/14e41a978b31e134ffa1170d8657f9dd98529aa3"
},
{
"tags": [
"patch"
],
"url": "https://github.com/a2aproject/a2a-go/releases/tag/v2.5.0"
},
{
"tags": [
"product"
],
"url": "https://github.com/a2aproject/a2a-go/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-27T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-27T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-27T09:52:46.000Z",
"value": "VulDB entry last update"
}
],
"title": "a2aproject a2a-go Distributed Manager distributed_manager.go Cancel denial of service",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-117504",
"datePublished": "2026-10-27T14:00:17.060Z",
"dateReserved": "2026-10-27T08:47:24.096Z",
"dateUpdated": "2026-10-27T14:00:17.060Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-117503 (GCVE-0-2026-117503)
Vulnerability from nvd – Published: 2026-10-27 13:45 – Updated: 2026-10-27 13:45 X_Open Source
VLAI
EPSS
VEX
Title
a2aproject a2a-go REST SSE handler rest.go resource consumption
Summary
A vulnerability was determined in a2aproject a2a-go up to 2.4.0. Impacted is an unknown function of the file a2asrv/rest.go of the component REST SSE handler. This manipulation causes resource consumption. It is possible to initiate the attack remotely. Upgrading to version 2.5.0 is recommended to address this issue. Patch name: ff6035bd21e44bb3ee1bfa547885b8c08327fa01. It is recommended to upgrade the affected component.
Severity
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/427070 | vdb-entry |
| https://vuldb.com/vuln/427070/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-117503 | third-party-advisory |
| https://vuldb.com/submit/1015052 | third-party-advisory |
| https://github.com/a2aproject/a2a-go/pull/396 | issue-trackingpatch |
| https://github.com/a2aproject/a2a-go/commit/ff603… | patch |
| https://github.com/a2aproject/a2a-go/releases/tag… | patch |
| https://github.com/a2aproject/a2a-go/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| a2aproject | a2a-go |
Affected:
2.0
Affected: 2.1 Affected: 2.2 Affected: 2.3 Affected: 2.4.0 Unaffected: 2.5.0 cpe:2.3:a:a2aproject:a2a-go:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:a2aproject:a2a-go:*:*:*:*:*:*:*:*"
],
"modules": [
"REST SSE handler"
],
"product": "a2a-go",
"vendor": "a2aproject",
"versions": [
{
"status": "affected",
"version": "2.0"
},
{
"status": "affected",
"version": "2.1"
},
{
"status": "affected",
"version": "2.2"
},
{
"status": "affected",
"version": "2.3"
},
{
"status": "affected",
"version": "2.4.0"
},
{
"status": "unaffected",
"version": "2.5.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "colorfullbz (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in a2aproject a2a-go up to 2.4.0. Impacted is an unknown function of the file a2asrv/rest.go of the component REST SSE handler. This manipulation causes resource consumption. It is possible to initiate the attack remotely. Upgrading to version 2.5.0 is recommended to address this issue. Patch name: ff6035bd21e44bb3ee1bfa547885b8c08327fa01. It is recommended to upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-404",
"description": "Denial of Service",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T13:45:17.953Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-427070 | a2aproject a2a-go REST SSE handler rest.go resource consumption",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/427070"
},
{
"name": "VDB-427070 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/427070/cti"
},
{
"name": "CVE-2026-117503 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-117503"
},
{
"name": "Submit #1015052 | a2aproject a2a-go \u2264 v2.4.0 CWE-400",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1015052"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/a2aproject/a2a-go/pull/396"
},
{
"tags": [
"patch"
],
"url": "https://github.com/a2aproject/a2a-go/commit/ff6035bd21e44bb3ee1bfa547885b8c08327fa01"
},
{
"tags": [
"patch"
],
"url": "https://github.com/a2aproject/a2a-go/releases/tag/v2.5.0"
},
{
"tags": [
"product"
],
"url": "https://github.com/a2aproject/a2a-go/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-27T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-27T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-27T09:52:42.000Z",
"value": "VulDB entry last update"
}
],
"title": "a2aproject a2a-go REST SSE handler rest.go resource consumption",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-117503",
"datePublished": "2026-10-27T13:45:17.953Z",
"dateReserved": "2026-10-27T08:47:20.319Z",
"dateUpdated": "2026-10-27T13:45:17.953Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116478 (GCVE-0-2026-116478)
Vulnerability from nvd – Published: 2026-10-26 19:30 – Updated: 2026-10-26 19:30 X_Open Source
VLAI
EPSS
VEX
Title
a2aproject a2a-go Push Notification agentexec.go CreateExecutor information exposure
Summary
A vulnerability was detected in a2aproject a2a-go up to 2.4.0. This affects the function CreateExecutor of the file a2asrv/agentexec.go of the component Push Notification Handler. The manipulation results in information exposure through error message. It is possible to launch the attack remotely. Upgrading to version 2.5.0 mitigates this issue. The patch is identified as f4d588216b0c9520e94d571bab725c38ce23064c. It is recommended to upgrade the affected component.
Severity
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/426391 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/426391/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-116478 | third-party-advisory |
| https://vuldb.com/submit/1014887 | third-party-advisory |
| https://github.com/a2aproject/a2a-go/pull/393 | issue-trackingpatch |
| https://github.com/a2aproject/a2a-go/commit/f4d58… | patch |
| https://github.com/a2aproject/a2a-go/releases/tag… | patch |
| https://github.com/a2aproject/a2a-go/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| a2aproject | a2a-go |
Affected:
2.0
Affected: 2.1 Affected: 2.2 Affected: 2.3 Affected: 2.4.0 Unaffected: 2.5.0 cpe:2.3:a:a2aproject:a2a-go:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:a2aproject:a2a-go:*:*:*:*:*:*:*:*"
],
"modules": [
"Push Notification Handler"
],
"product": "a2a-go",
"vendor": "a2aproject",
"versions": [
{
"status": "affected",
"version": "2.0"
},
{
"status": "affected",
"version": "2.1"
},
{
"status": "affected",
"version": "2.2"
},
{
"status": "affected",
"version": "2.3"
},
{
"status": "affected",
"version": "2.4.0"
},
{
"status": "unaffected",
"version": "2.5.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "colorfullbz (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in a2aproject a2a-go up to 2.4.0. This affects the function CreateExecutor of the file a2asrv/agentexec.go of the component Push Notification Handler. The manipulation results in information exposure through error message. It is possible to launch the attack remotely. Upgrading to version 2.5.0 mitigates this issue. The patch is identified as f4d588216b0c9520e94d571bab725c38ce23064c. It is recommended to upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "Information Exposure Through Error Message",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Information Disclosure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T19:30:19.254Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-426391 | a2aproject a2a-go Push Notification agentexec.go CreateExecutor information exposure",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/426391"
},
{
"name": "VDB-426391 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/426391/cti"
},
{
"name": "CVE-2026-116478 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-116478"
},
{
"name": "Submit #1014887 | a2aproject a2a-go \u2264 v2.4.0 CWE-209",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1014887"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/a2aproject/a2a-go/pull/393"
},
{
"tags": [
"patch"
],
"url": "https://github.com/a2aproject/a2a-go/commit/f4d588216b0c9520e94d571bab725c38ce23064c"
},
{
"tags": [
"patch"
],
"url": "https://github.com/a2aproject/a2a-go/releases/tag/v2.5.0"
},
{
"tags": [
"product"
],
"url": "https://github.com/a2aproject/a2a-go/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-26T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-26T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-26T12:05:03.000Z",
"value": "VulDB entry last update"
}
],
"title": "a2aproject a2a-go Push Notification agentexec.go CreateExecutor information exposure",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-116478",
"datePublished": "2026-10-26T19:30:19.254Z",
"dateReserved": "2026-10-26T10:59:44.115Z",
"dateUpdated": "2026-10-26T19:30:19.254Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-117504 (GCVE-0-2026-117504)
Vulnerability from cvelistv5 – Published: 2026-10-27 14:00 – Updated: 2026-10-27 14:00 X_Open Source
VLAI
EPSS
VEX
Title
a2aproject a2a-go Distributed Manager distributed_manager.go Cancel denial of service
Summary
A vulnerability was identified in a2aproject a2a-go up to 2.4.0. The affected element is the function Cancel of the file internal/taskexec/distributed_manager.go of the component Distributed Manager. Such manipulation leads to denial of service. It is possible to launch the attack remotely. Upgrading to version 2.5.0 is sufficient to fix this issue. The name of the patch is 14e41a978b31e134ffa1170d8657f9dd98529aa3. Upgrading the affected component is advised.
Severity
CWE
- CWE-404 - Denial of Service
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/427071 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/427071/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-117504 | third-party-advisory |
| https://vuldb.com/submit/1015053 | third-party-advisory |
| https://github.com/a2aproject/a2a-go/pull/409 | issue-trackingpatch |
| https://github.com/a2aproject/a2a-go/commit/14e41… | patch |
| https://github.com/a2aproject/a2a-go/releases/tag… | patch |
| https://github.com/a2aproject/a2a-go/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| a2aproject | a2a-go |
Affected:
2.0
Affected: 2.1 Affected: 2.2 Affected: 2.3 Affected: 2.4.0 Unaffected: 2.5.0 cpe:2.3:a:a2aproject:a2a-go:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:a2aproject:a2a-go:*:*:*:*:*:*:*:*"
],
"modules": [
"Distributed Manager"
],
"product": "a2a-go",
"vendor": "a2aproject",
"versions": [
{
"status": "affected",
"version": "2.0"
},
{
"status": "affected",
"version": "2.1"
},
{
"status": "affected",
"version": "2.2"
},
{
"status": "affected",
"version": "2.3"
},
{
"status": "affected",
"version": "2.4.0"
},
{
"status": "unaffected",
"version": "2.5.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "colorfullbz (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in a2aproject a2a-go up to 2.4.0. The affected element is the function Cancel of the file internal/taskexec/distributed_manager.go of the component Distributed Manager. Such manipulation leads to denial of service. It is possible to launch the attack remotely. Upgrading to version 2.5.0 is sufficient to fix this issue. The name of the patch is 14e41a978b31e134ffa1170d8657f9dd98529aa3. Upgrading the affected component is advised."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-404",
"description": "Denial of Service",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T14:00:17.060Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-427071 | a2aproject a2a-go Distributed Manager distributed_manager.go Cancel denial of service",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/427071"
},
{
"name": "VDB-427071 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/427071/cti"
},
{
"name": "CVE-2026-117504 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-117504"
},
{
"name": "Submit #1015053 | a2aproject a2a-go \u2264 v2.4.0 CWE-404",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1015053"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/a2aproject/a2a-go/pull/409"
},
{
"tags": [
"patch"
],
"url": "https://github.com/a2aproject/a2a-go/commit/14e41a978b31e134ffa1170d8657f9dd98529aa3"
},
{
"tags": [
"patch"
],
"url": "https://github.com/a2aproject/a2a-go/releases/tag/v2.5.0"
},
{
"tags": [
"product"
],
"url": "https://github.com/a2aproject/a2a-go/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-27T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-27T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-27T09:52:46.000Z",
"value": "VulDB entry last update"
}
],
"title": "a2aproject a2a-go Distributed Manager distributed_manager.go Cancel denial of service",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-117504",
"datePublished": "2026-10-27T14:00:17.060Z",
"dateReserved": "2026-10-27T08:47:24.096Z",
"dateUpdated": "2026-10-27T14:00:17.060Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-117503 (GCVE-0-2026-117503)
Vulnerability from cvelistv5 – Published: 2026-10-27 13:45 – Updated: 2026-10-27 13:45 X_Open Source
VLAI
EPSS
VEX
Title
a2aproject a2a-go REST SSE handler rest.go resource consumption
Summary
A vulnerability was determined in a2aproject a2a-go up to 2.4.0. Impacted is an unknown function of the file a2asrv/rest.go of the component REST SSE handler. This manipulation causes resource consumption. It is possible to initiate the attack remotely. Upgrading to version 2.5.0 is recommended to address this issue. Patch name: ff6035bd21e44bb3ee1bfa547885b8c08327fa01. It is recommended to upgrade the affected component.
Severity
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/427070 | vdb-entry |
| https://vuldb.com/vuln/427070/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-117503 | third-party-advisory |
| https://vuldb.com/submit/1015052 | third-party-advisory |
| https://github.com/a2aproject/a2a-go/pull/396 | issue-trackingpatch |
| https://github.com/a2aproject/a2a-go/commit/ff603… | patch |
| https://github.com/a2aproject/a2a-go/releases/tag… | patch |
| https://github.com/a2aproject/a2a-go/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| a2aproject | a2a-go |
Affected:
2.0
Affected: 2.1 Affected: 2.2 Affected: 2.3 Affected: 2.4.0 Unaffected: 2.5.0 cpe:2.3:a:a2aproject:a2a-go:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:a2aproject:a2a-go:*:*:*:*:*:*:*:*"
],
"modules": [
"REST SSE handler"
],
"product": "a2a-go",
"vendor": "a2aproject",
"versions": [
{
"status": "affected",
"version": "2.0"
},
{
"status": "affected",
"version": "2.1"
},
{
"status": "affected",
"version": "2.2"
},
{
"status": "affected",
"version": "2.3"
},
{
"status": "affected",
"version": "2.4.0"
},
{
"status": "unaffected",
"version": "2.5.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "colorfullbz (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in a2aproject a2a-go up to 2.4.0. Impacted is an unknown function of the file a2asrv/rest.go of the component REST SSE handler. This manipulation causes resource consumption. It is possible to initiate the attack remotely. Upgrading to version 2.5.0 is recommended to address this issue. Patch name: ff6035bd21e44bb3ee1bfa547885b8c08327fa01. It is recommended to upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-404",
"description": "Denial of Service",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-27T13:45:17.953Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-427070 | a2aproject a2a-go REST SSE handler rest.go resource consumption",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/427070"
},
{
"name": "VDB-427070 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/427070/cti"
},
{
"name": "CVE-2026-117503 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-117503"
},
{
"name": "Submit #1015052 | a2aproject a2a-go \u2264 v2.4.0 CWE-400",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1015052"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/a2aproject/a2a-go/pull/396"
},
{
"tags": [
"patch"
],
"url": "https://github.com/a2aproject/a2a-go/commit/ff6035bd21e44bb3ee1bfa547885b8c08327fa01"
},
{
"tags": [
"patch"
],
"url": "https://github.com/a2aproject/a2a-go/releases/tag/v2.5.0"
},
{
"tags": [
"product"
],
"url": "https://github.com/a2aproject/a2a-go/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-27T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-27T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-27T09:52:42.000Z",
"value": "VulDB entry last update"
}
],
"title": "a2aproject a2a-go REST SSE handler rest.go resource consumption",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-117503",
"datePublished": "2026-10-27T13:45:17.953Z",
"dateReserved": "2026-10-27T08:47:20.319Z",
"dateUpdated": "2026-10-27T13:45:17.953Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-116478 (GCVE-0-2026-116478)
Vulnerability from cvelistv5 – Published: 2026-10-26 19:30 – Updated: 2026-10-26 19:30 X_Open Source
VLAI
EPSS
VEX
Title
a2aproject a2a-go Push Notification agentexec.go CreateExecutor information exposure
Summary
A vulnerability was detected in a2aproject a2a-go up to 2.4.0. This affects the function CreateExecutor of the file a2asrv/agentexec.go of the component Push Notification Handler. The manipulation results in information exposure through error message. It is possible to launch the attack remotely. Upgrading to version 2.5.0 mitigates this issue. The patch is identified as f4d588216b0c9520e94d571bab725c38ce23064c. It is recommended to upgrade the affected component.
Severity
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/426391 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/426391/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-116478 | third-party-advisory |
| https://vuldb.com/submit/1014887 | third-party-advisory |
| https://github.com/a2aproject/a2a-go/pull/393 | issue-trackingpatch |
| https://github.com/a2aproject/a2a-go/commit/f4d58… | patch |
| https://github.com/a2aproject/a2a-go/releases/tag… | patch |
| https://github.com/a2aproject/a2a-go/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| a2aproject | a2a-go |
Affected:
2.0
Affected: 2.1 Affected: 2.2 Affected: 2.3 Affected: 2.4.0 Unaffected: 2.5.0 cpe:2.3:a:a2aproject:a2a-go:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:a2aproject:a2a-go:*:*:*:*:*:*:*:*"
],
"modules": [
"Push Notification Handler"
],
"product": "a2a-go",
"vendor": "a2aproject",
"versions": [
{
"status": "affected",
"version": "2.0"
},
{
"status": "affected",
"version": "2.1"
},
{
"status": "affected",
"version": "2.2"
},
{
"status": "affected",
"version": "2.3"
},
{
"status": "affected",
"version": "2.4.0"
},
{
"status": "unaffected",
"version": "2.5.0"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "colorfullbz (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was detected in a2aproject a2a-go up to 2.4.0. This affects the function CreateExecutor of the file a2asrv/agentexec.go of the component Push Notification Handler. The manipulation results in information exposure through error message. It is possible to launch the attack remotely. Upgrading to version 2.5.0 mitigates this issue. The patch is identified as f4d588216b0c9520e94d571bab725c38ce23064c. It is recommended to upgrade the affected component."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "Information Exposure Through Error Message",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Information Disclosure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-26T19:30:19.254Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-426391 | a2aproject a2a-go Push Notification agentexec.go CreateExecutor information exposure",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/426391"
},
{
"name": "VDB-426391 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/426391/cti"
},
{
"name": "CVE-2026-116478 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-116478"
},
{
"name": "Submit #1014887 | a2aproject a2a-go \u2264 v2.4.0 CWE-209",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1014887"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/a2aproject/a2a-go/pull/393"
},
{
"tags": [
"patch"
],
"url": "https://github.com/a2aproject/a2a-go/commit/f4d588216b0c9520e94d571bab725c38ce23064c"
},
{
"tags": [
"patch"
],
"url": "https://github.com/a2aproject/a2a-go/releases/tag/v2.5.0"
},
{
"tags": [
"product"
],
"url": "https://github.com/a2aproject/a2a-go/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-26T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-26T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-26T12:05:03.000Z",
"value": "VulDB entry last update"
}
],
"title": "a2aproject a2a-go Push Notification agentexec.go CreateExecutor information exposure",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-116478",
"datePublished": "2026-10-26T19:30:19.254Z",
"dateReserved": "2026-10-26T10:59:44.115Z",
"dateUpdated": "2026-10-26T19:30:19.254Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}