{"id":"CVE-2026-117504","kind":"vulnerability","aliases":["CVE-2026-117504"],"related":[],"title":"a2a-go: task cancel flaw in distributed manager allows remote denial of service","description":"A vulnerability was identified in a2aproject a2a-go up to 2.4.0. The affected element is the function Cancel of the file internal/taskexec/distributed_manager.go of the component Distributed Manager. Such manipulation leads to denial of service. It is possible to launch the attack remotely. Upgrading to version 2.5.0 is sufficient to fix this issue. The name of the patch is 14e41a978b31e134ffa1170d8657f9dd98529aa3. Upgrading the affected component is advised.","summary":"The Cancel function in a2a-go's distributed task manager can be manipulated to cause a denial of service. The sources say the attack can be launched remotely.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["a2a","go","package","self-hosted"],"not_affected_if":["already-on-2.5.0"],"how_to_check":"- Check the a2a-go version in `go.mod` or with `go list -m github.com/a2aproject/a2a-go`\n- Look for a use of the distributed manager in `internal/taskexec/distributed_manager.go`","fix":"- Upgrade a2a-go to `2.5.0` (patch commit `14e41a978b31e134ffa1170d8657f9dd98529aa3`)","status":"open","published_at":"2026-10-27T14:16:35+00:00","first_seen_at":"2026-10-27T14:32:18+00:00","triaged_at":"2026-10-27T14:33:04+00:00","updated_at":"2026-10-27T14:33:04+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T14:33:04Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade a2a-go to `2.5.0` (patch commit `14e41a978b31e134ffa1170d8657f9dd98529aa3`)","reach":"internet","title":"a2a-go: task cancel flaw in distributed manager allows remote denial of service","impact":"low","summary":"The Cancel function in a2a-go's distributed task manager can be manipulated to cause a denial of service. The sources say the attack can be launched remotely.","category":"package","nicknames":[],"who_cares":["go","a2a","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Remote requests can crash or stall task cancellation, causing denial of service","analyst_note":"","how_to_check":"- Check the a2a-go version in `go.mod` or with `go list -m github.com/a2aproject/a2a-go`\n- Look for a use of the distributed manager in `internal/taskexec/distributed_manager.go`","needs_analyst":false,"not_affected_if":["already-on-2.5.0"],"who_is_affected":"Teams running a2a-go up to and including `2.4.0` in a service that uses the distributed task execution manager and cancellation. The sources do not say which deployment setups use the distributed manager by default, so teams that only use a single-node setup should still check. Teams already on `2.5.0` or later are not affected.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000591,"input_tokens":3380,"output_tokens":505,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-117504':17A,20A '-2026':16A,19A '14e41':115C '2.4.0':67C '2.5.0':102C 'a2a':2A,21B,32B,63C 'a2a-go':1A,31B,62C 'a2aproject':61C 'a978b31e134ffa1170d8657f9dd98529aa3':116C 'advis':122C 'affect':69C,119C 'allow':10A 'attack':51B,97C 'cancel':5A,28B,74C 'caus':42B 'compon':81C,120C 'cve':15A,18A 'denial':12A,44B,88C 'distribut':8A,35B,82C 'element':70C 'file':77C 'fix':106C 'flaw':6A 'function':29B,73C 'go':3A,22B,33B,64C 'host':26B 'identifi':59C 'internal/taskexec/distributed_manager.go':78C 'issu':108C 'launch':54B,95C 'lead':86C 'manag':9A,37B,83C 'manipul':40B,85C 'name':110C 'packag':23B 'patch':113C 'possibl':93C 'remot':11A,55B,98C 'say':49B 'self':25B 'self-host':24B 'servic':14A,46B,90C 'sourc':48B 'suffici':104C 'task':4A,36B 'upgrad':99C,117C 'version':101C 'vulner':57C","nicknames":[],"mitigations":[],"who_affected":"Teams running a2a-go up to and including `2.4.0` in a service that uses the distributed task execution manager and cancellation. The sources do not say which deployment setups use the distributed manager by default, so teams that only use a single-node setup should still check. Teams already on `2.5.0` or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T14:16:35+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117504","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117504","severity":null,"published_at":"2026-10-27T14:16:35+00:00","modified_at":"2026-10-27T14:16:35+00:00","first_seen_at":"2026-10-27T14:32:18+00:00","fetched_at":"2026-10-27T14:32:18+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}