CVE-2026-117504
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk46th percentile - higher than 46% of all known CVEs
Summary
A vulnerability was identified in a2aproject a2a-go up to 2.4.0 in the Cancel function of internal/taskexec/distributed_manager.go of the Distributed Manager component. Manipulation leads to denial of service, and the attack can be launched remotely.
Risk Assessment
An attacker can remotely cause denial of service, potentially disrupting systems using a2a-go. This may affect service availability.
Recommendation
Upgrade a2a-go to version 2.5.0 or later, which contains the fix. Until then, consider restricting access to vulnerable functions.
Other vulnerabilities in a2a-go
See all- CVE-2026-117503Medium
A vulnerability was determined in a2aproject a2a-go up to 2.4.0 in an unknown function of a2asrv/rest.go of the REST SSE handler component. Manipulation causes resource consumption, and the attack can be initiated remotely.
- CVE-2026-116478Medium
A vulnerability was detected in a2a-go up to 2.4.0 affecting the CreateExecutor function in a2asrv/agentexec.go of the Push Notification Handler component. The manipulation results in information exposure through error messages. The attack can be launched remotely, and upgrading to version 2.5.0 mitigates the issue.
Original NVD description (English source)
A vulnerability was identified in a2aproject a2a-go up to 2.4.0. The affected element is the function Cancel of the file internal/taskexec/distributed_manager.go of the component Distributed Manager. Such manipulation leads to denial of service. It is possible to launch the attack remotely. Upgrading to version 2.5.0 is sufficient to fix this issue. The name of the patch is 14e41a978b31e134ffa1170d8657f9dd98529aa3. Upgrading the affected component is advised.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS