CVE-2026-117504
Deferred Deferred - Pending Action

Denial of Service in a2a-go Distributed Manager

Publication date: 2026-10-27

Last updated on: 2026-10-27

Assigner: VulDB

Description
A vulnerability was identified in a2aproject a2a-go up to 2.4.0. The affected element is the function Cancel of the file internal/taskexec/distributed_manager.go of the component Distributed Manager. Such manipulation leads to denial of service. It is possible to launch the attack remotely. Upgrading to version 2.5.0 is sufficient to fix this issue. The name of the patch is 14e41a978b31e134ffa1170d8657f9dd98529aa3. Upgrading the affected component is advised.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-27
Last Modified
2026-10-27
Generated
2026-10-27
AI Q&A
2026-10-27
EPSS Evaluated
N/A
NVD
CVE-2026-117504
EUVD
EUVD-2026-111030

Affected Vendors & Products

Showing 5 associated CPEs
Vendor Product Version / Range
a2aproject a2a-go 2.0
a2aproject a2a-go 2.1
a2aproject a2a-go 2.2
a2aproject a2a-go 2.3
a2aproject a2a-go 2.4.0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-404 The product does not release or incorrectly releases a resource before it is made available for re-use.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a denial of service vulnerability in the a2a-go project up to version 2.4.0. The issue is in the Cancel function of the Distributed Manager component. An attacker can remotely trigger this function to cause a service disruption.

Detection Guidance

To detect this vulnerability, check the version of a2a-go installed on your system. If it is version 2.4.0 or earlier, the system is vulnerable. Use commands like 'a2a-go version' or inspect package manifests for the version number.

Impact Analysis

The vulnerability allows remote attackers to cause a denial of service, potentially making the affected service unavailable. This could disrupt operations relying on the a2a-go component.

Mitigation Strategies

Upgrade the a2a-go component to version 2.5.0 or later. This can be done by updating the package using your package manager or downloading the patched version directly. The patch commit is 14e41a978b31e134ffa1170d8657f9dd98529aa3.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-117504. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart