CVE-2026-117504 json
a2aproject a2a-go Distributed Manager distributed_manager.go Cancel denial of service
published 13d ago modified 7d ago also EUVD-2026-111030
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 46%
- public exploits
- 0
- none known
Summary
A vulnerability was identified in a2aproject a2a-go up to 2.4.0. The affected element is the function Cancel of the file internal/taskexec/distributed_manager.go of the component Distributed Manager. Such manipulation leads to denial of service. It is possible to launch the attack remotely. Upgrading to version 2.5.0 is sufficient to fix this issue. The name of the patch is 14e41a978b31e134ffa1170d8657f9dd98529aa3. Upgrading the affected component is advised.
Patch / fix
- a2aproject a2a-go 2.5.0
- github.com/a2aproject/a2a-go@14e41a9 commit
- github.com/a2aproject/a2a-go#409 pull request
- github.com/a2aproject/a2a-go/releases/tag/v2.5.0 release
Is CVE-2026-117504 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 7d ago
Exploit prediction
0.55% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X |
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C |
| CNA | 3.0 | 5.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C |
| CNA | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P/E:ND/RL:OF/RC:C |
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| CNA | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:N/I:N/A:P |
Affected products
- a2aproject a2a-go
Classification
- Weakness
-
- CWE-404 Improper Resource Shutdown or Release
References
-
github.com
/a2aproject/a2a-go/pull/409
issue-tracking, patch
-
github.com
/a2aproject/a2a-go/commit/14e41a978b31e134ffa1170d8657f9dd98529aa3
patch
-
github.com
/a2aproject/a2a-go/releases/tag/v2.5.0
patch
-
vuldb.com
/vuln/427071
vdb-entry, technical-description
-
vuldb.com
/vuln/427071/cti
signature, permissions-required
-
vuldb.com
/cve/CVE-2026-117504
third-party-advisory
-
vuldb.com
/submit/1015053
third-party-advisory
-
github.com
/a2aproject/a2a-go/
product
Sources
- CVE List CVE-2026-117504
- NVD CVE-2026-117504
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.