{"id":"CVE-2026-117503","kind":"vulnerability","aliases":["CVE-2026-117503"],"related":[],"title":"a2a-go: REST SSE handler lets remote callers exhaust server resources","description":"A vulnerability was determined in a2aproject a2a-go up to 2.4.0. Impacted is an unknown function of the file a2asrv/rest.go of the component REST SSE handler. This manipulation causes resource consumption. It is possible to initiate the attack remotely. Upgrading to version 2.5.0 is recommended to address this issue. Patch name: ff6035bd21e44bb3ee1bfa547885b8c08327fa01. It is recommended to upgrade the affected component.","summary":"The REST SSE handler in a2a-go up to 2.4.0 (a2asrv/rest.go) can be driven into heavy resource consumption by a remote request. An attacker can cause denial of service on a server running the affected version.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["a2a","go","package","self-hosted"],"not_affected_if":["client-only","no-rest-sse-handler"],"how_to_check":"- Run `go list -m github.com/a2aproject/a2a-go` in the project and compare the version against `2.4.0`\n- Search the lockfile or `go.mod` for `a2aproject/a2a-go` and confirm whether a version at or below `2.4.0` is pinned","fix":"- Upgrade a2a-go to `2.5.0` or later (commit ff6035bd21e44bb3ee1bfa547885b8c08327fa01 is the patch)\n- Rebuild and redeploy any service that imports a2a-go","status":"open","published_at":"2026-10-27T14:16:35+00:00","first_seen_at":"2026-10-27T14:32:18+00:00","triaged_at":"2026-10-27T14:33:06+00:00","updated_at":"2026-10-27T14:33:06+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T14:33:06Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade a2a-go to `2.5.0` or later (commit ff6035bd21e44bb3ee1bfa547885b8c08327fa01 is the patch)\n- Rebuild and redeploy any service that imports a2a-go","reach":"internet","title":"a2a-go: REST SSE handler lets remote callers exhaust server resources","impact":"low","summary":"The REST SSE handler in a2a-go up to 2.4.0 (a2asrv/rest.go) can be driven into heavy resource consumption by a remote request. An attacker can cause denial of service on a server running the affected version.","category":"package","nicknames":[],"who_cares":["go","a2a","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Server resources are exhausted, causing denial of service","analyst_note":"","how_to_check":"- Run `go list -m github.com/a2aproject/a2a-go` in the project and compare the version against `2.4.0`\n- Search the lockfile or `go.mod` for `a2aproject/a2a-go` and confirm whether a version at or below `2.4.0` is pinned","needs_analyst":false,"not_affected_if":["no-rest-sse-handler","client-only"],"who_is_affected":"Services that import a2a-go up to 2.4.0 and expose its REST SSE endpoint to remote clients are exposed. Projects that only use the library's client side, or that do not serve the REST SSE handler, can skip it. The sources do not say which default configuration enables the handler.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.00062,"input_tokens":3372,"output_tokens":566,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-117503':15A,18A '-2026':14A,17A '2.4.0':35B,73C '2.5.0':105C 'a2a':2A,19B,31B,69C 'a2a-go':1A,30B,68C 'a2aproject':67C 'a2asrv/rest.go':36B,82C 'address':109C 'affect':60B,121C 'attack':49B,100C 'caller':9A 'caus':51B,91C 'compon':85C,122C 'consumpt':43B,93C 'cve':13A,16A 'denial':52B 'determin':65C 'driven':39B 'exhaust':10A 'ff6035bd21e44bb3ee1bfa547885b8c08327fa01':114C 'file':81C 'function':78C 'go':3A,20B,32B,70C 'handler':6A,28B,88C 'heavi':41B 'host':24B 'impact':74C 'initi':98C 'issu':111C 'let':7A 'manipul':90C 'name':113C 'packag':21B 'patch':112C 'possibl':96C 'recommend':107C,117C 'remot':8A,46B,101C 'request':47B 'resourc':12A,42B,92C 'rest':4A,26B,86C 'run':58B 'self':23B 'self-host':22B 'server':11A,57B 'servic':54B 'sse':5A,27B,87C 'unknown':77C 'upgrad':102C,119C 'version':61B,104C 'vulner':63C","nicknames":[],"mitigations":[],"who_affected":"Services that import a2a-go up to 2.4.0 and expose its REST SSE endpoint to remote clients are exposed. Projects that only use the library's client side, or that do not serve the REST SSE handler, can skip it. The sources do not say which default configuration enables the handler.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:35+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117503","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117503","severity":null,"published_at":"2026-10-27T14:16:35+00:00","modified_at":"2026-10-27T14:16:35+00:00","first_seen_at":"2026-10-27T14:32:18+00:00","fetched_at":"2026-10-27T14:32:18+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}