---
id: "CVE-2026-117504"
kind: "vulnerability"
aliases: ["CVE-2026-117504"]
title: "a2a-go: task cancel flaw in distributed manager allows remote denial of service"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["a2a", "go", "package", "self-hosted"]
not_affected_if: ["already-on-2.5.0"]
published_at: "2026-10-27T14:16:35+00:00"
first_seen_at: "2026-10-27T14:32:18+00:00"
updated_at: "2026-10-27T14:33:04+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117504", "first_seen_at": "2026-10-27T14:32:18+00:00"}]
---

# a2a-go: task cancel flaw in distributed manager allows remote denial of service

The Cancel function in a2a-go's distributed task manager can be manipulated to cause a denial of service. The sources say the attack can be launched remotely.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the a2a-go version in `go.mod` or with `go list -m github.com/a2aproject/a2a-go`
- Look for a use of the distributed manager in `internal/taskexec/distributed_manager.go`

## Fix

- Upgrade a2a-go to `2.5.0` (patch commit `14e41a978b31e134ffa1170d8657f9dd98529aa3`)

## Timeline

- 2026-10-27T14:32:18+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117504

## From the sources

A vulnerability was identified in a2aproject a2a-go up to 2.4.0. The affected element is the function Cancel of the file internal/taskexec/distributed_manager.go of the component Distributed Manager. Such manipulation leads to denial of service. It is possible to launch the attack remotely. Upgrading to version 2.5.0 is sufficient to fix this issue. The name of the patch is 14e41a978b31e134ffa1170d8657f9dd98529aa3. Upgrading the affected component is advised.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_