Live › vulnerability › CVE-2026-117506
Go to dashboardIn a2a-java up to 1.2.0.Final, the push notification config store's setInfo method can be manipulated to consume excessive resources. The sources describe the impact only as resource consumption, which means a remote attacker could degrade the service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 15:32 UTC. All times on this page are UTC.
Applications that embed a2a-java up to 1.2.0.Final and expose the push notification config path to remote callers are exposed. The sources do not say whether authentication is required or whether the default configuration is affected, so teams not using push notifications may still want to check.
No product ranges from the sources yet.
1.2.0.Final or earlier.1.3.0.Final or later, which the sources say mitigates the issue (patch commit b478810a03b4a16841d36aca5c6e87d8f48fce67).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A weakness has been identified in a2aproject a2a-java up to 1.2.0.Final. This affects the function InMemoryPushNotificationConfigStore.setInfo of the file extras/push-notification-config-store-database-jpa/src/main/java/org/a2aproject/sdk/extras/pushnotificationconfigstore/database/jpa/JpaDatabasePushNotificationConfigStore.java of the component Push Notification Config Store. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. Upgrading to version 1.3.0.Final mitigates this issue. This patch is called b478810a03b4a16841d36aca5c6e87d8f48fce67. You should upgrade the affected component.
This page as .md · .json · in your agent: get_signal("CVE-2026-117506")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.