Live › vulnerability › CVE-2026-117504
Go to dashboardThe Cancel function in a2a-go's distributed task manager can be manipulated to cause a denial of service. The sources say the attack can be launched remotely.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 14:32 UTC. All times on this page are UTC.
Teams running a2a-go up to and including in a service that uses the distributed task execution manager and cancellation. The sources do not say which deployment setups use the distributed manager by default, so teams that only use a single-node setup should still check. Teams already on or later are not affected.
2.4.02.5.0No product ranges from the sources yet.
go.mod or with go list -m github.com/a2aproject/a2a-gointernal/taskexec/distributed_manager.go2.5.0 (patch commit 14e41a978b31e134ffa1170d8657f9dd98529aa3)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was identified in a2aproject a2a-go up to 2.4.0. The affected element is the function Cancel of the file internal/taskexec/distributed_manager.go of the component Distributed Manager. Such manipulation leads to denial of service. It is possible to launch the attack remotely. Upgrading to version 2.5.0 is sufficient to fix this issue. The name of the patch is 14e41a978b31e134ffa1170d8657f9dd98529aa3. Upgrading the affected component is advised.
This page as .md · .json · in your agent: get_signal("CVE-2026-117504")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.