Live › vulnerability › CVE-2026-117503
Go to dashboardThe REST SSE handler in a2a-go up to 2.4.0 (a2asrv/rest.go) can be driven into heavy resource consumption by a remote request. An attacker can cause denial of service on a server running the affected version.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Services that import a2a-go up to 2.4.0 and expose its REST SSE endpoint to remote clients are exposed. Projects that only use the library's client side, or that do not serve the REST SSE handler, can skip it. The sources do not say which default configuration enables the handler.
No product ranges from the sources yet.
go list -m github.com/a2aproject/a2a-go in the project and compare the version against 2.4.0go.mod for a2aproject/a2a-go and confirm whether a version at or below 2.4.0 is pinned2.5.0 or later (commit ff6035bd21e44bb3ee1bfa547885b8c08327fa01 is the patch)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was determined in a2aproject a2a-go up to 2.4.0. Impacted is an unknown function of the file a2asrv/rest.go of the component REST SSE handler. This manipulation causes resource consumption. It is possible to initiate the attack remotely. Upgrading to version 2.5.0 is recommended to address this issue. Patch name: ff6035bd21e44bb3ee1bfa547885b8c08327fa01. It is recommended to upgrade the affected component.
This page as .md · .json · in your agent: get_signal("CVE-2026-117503")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.