{"id":"CVE-2026-117506","kind":"vulnerability","aliases":["CVE-2026-117506"],"related":[],"title":"a2a-java: push notification config store lets remote requests exhaust resources","description":"A weakness has been identified in a2aproject a2a-java up to 1.2.0.Final. This affects the function InMemoryPushNotificationConfigStore.setInfo of the file extras/push-notification-config-store-database-jpa/src/main/java/org/a2aproject/sdk/extras/pushnotificationconfigstore/database/jpa/JpaDatabasePushNotificationConfigStore.java of the component Push Notification Config Store. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. Upgrading to version 1.3.0.Final mitigates this issue. This patch is called b478810a03b4a16841d36aca5c6e87d8f48fce67. You should upgrade the affected component.","summary":"In a2a-java up to 1.2.0.Final, the push notification config store's setInfo method can be manipulated to consume excessive resources. The sources describe the impact only as resource consumption, which means a remote attacker could degrade the service.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["a2a-java","java","package","self-hosted"],"not_affected_if":["version-1.3.0-or-later"],"how_to_check":"- Check the a2a-java version in the project's build file (Maven or Gradle) and confirm whether it is `1.2.0.Final` or earlier.\n- Check whether the application uses the push notification config store, including the JPA database implementation.","fix":"- Upgrade a2a-java to `1.3.0.Final` or later, which the sources say mitigates the issue (patch commit `b478810a03b4a16841d36aca5c6e87d8f48fce67`).","status":"open","published_at":"2026-10-27T15:16:57+00:00","first_seen_at":"2026-10-27T15:32:58+00:00","triaged_at":"2026-10-27T15:33:28+00:00","updated_at":"2026-10-27T15:33:28+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-27T15:33:28Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade a2a-java to `1.3.0.Final` or later, which the sources say mitigates the issue (patch commit `b478810a03b4a16841d36aca5c6e87d8f48fce67`).","reach":"internet","title":"a2a-java: push notification config store lets remote requests exhaust resources","impact":"low","summary":"In a2a-java up to 1.2.0.Final, the push notification config store's setInfo method can be manipulated to consume excessive resources. The sources describe the impact only as resource consumption, which means a remote attacker could degrade the service.","category":"package","nicknames":[],"who_cares":["java","a2a-java","self-hosted"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Remote requests exhaust server resources and degrade the service.","analyst_note":"Confirm from the NVD entry or the upstream advisory whether authentication or a non-default feature is required, and whether the vulnerable path is reachable by default.","how_to_check":"- Check the a2a-java version in the project's build file (Maven or Gradle) and confirm whether it is `1.2.0.Final` or earlier.\n- Check whether the application uses the push notification config store, including the JPA database implementation.","needs_analyst":true,"not_affected_if":["version-1.3.0-or-later"],"who_is_affected":"Applications that embed a2a-java up to 1.2.0.Final and expose the push notification config path to remote callers are exposed. The sources do not say whether authentication is required or whether the default configuration is affected, so teams not using push notifications may still want to check.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000637,"input_tokens":3456,"output_tokens":583,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-117506':15A,18A '-2026':14A,17A '1.2.0.final':33B,79C '1.3.0.final':113C 'a2a':2A,20B,29B,75C 'a2a-java':1A,19B,28B,74C 'a2aproject':73C 'affect':81C,126C 'attack':62B,105C 'b478810a03b4a16841d36aca5c6e87d8f48fce67':121C 'call':120C 'compon':91C,127C 'config':6A,37B,94C 'consum':46B 'consumpt':57B,103C 'could':63B 'cve':13A,16A 'degrad':64B 'describ':51B 'excess':47B 'execut':96C 'exhaust':11A 'extras/push-notification-config-store-database-jpa/src/main/java/org/a2aproject/sdk/extras/pushnotificationconfigstore/database/jpa/jpadatabasepushnotificationconfigstore.java':88C 'file':87C 'function':83C 'host':26B 'identifi':71C 'impact':53B 'inmemorypushnotificationconfigstore.setinfo':84C 'issu':116C 'java':3A,21B,22B,30B,76C 'launch':108C 'lead':100C 'let':8A 'manipul':44B,98C 'mean':59B 'method':41B 'mitig':114C 'notif':5A,36B,93C 'packag':23B 'patch':118C 'push':4A,35B,92C 'remot':9A,61B,109C 'request':10A 'resourc':12A,48B,56B,102C 'self':25B 'self-host':24B 'servic':66B 'setinfo':40B 'sourc':50B 'store':7A,38B,95C 'upgrad':110C,124C 'version':112C 'weak':68C","nicknames":[],"mitigations":[],"who_affected":"Applications that embed a2a-java up to 1.2.0.Final and expose the push notification config path to remote callers are exposed. The sources do not say whether authentication is required or whether the default configuration is affected, so teams not using push notifications may still want to check.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-27T15:16:57+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117506","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117506","severity":null,"published_at":"2026-10-27T15:16:57+00:00","modified_at":"2026-10-27T15:16:57+00:00","first_seen_at":"2026-10-27T15:32:58+00:00","fetched_at":"2026-10-27T15:32:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}