CVE-2026-117504

EUVD-2026-111030
A vulnerability was identified in a2aproject a2a-go up to 2.4.0. The affected element is the function Cancel of the file internal/taskexec/distributed_manager.go of the component Distributed Manager. Such manipulation leads to denial of service. It is possible to launch the attack remotely. Upgrading to version 2.5.0 is sufficient to fix this issue. The name of the patch is 14e41a978b31e134ffa1170d8657f9dd98529aa3. Upgrading the affected component is advised.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.3 MEDIUM
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/a2aproject/a2a-go/
https://github.com/a2aproject/a2a-go/commit/14e41a978b31e134ffa1170d8657f9dd98529aa3
https://github.com/a2aproject/a2a-go/pull/409
https://github.com/a2aproject/a2a-go/releases/tag/v2.5.0
https://vuldb.com/cve/CVE-2026-117504
https://vuldb.com/submit/1015053
https://vuldb.com/vuln/427071
https://vuldb.com/vuln/427071/cti