A vulnerability was identified in a2aproject a2a-go up to 2.4.0. The affected element is the function Cancel of the file internal/taskexec/distributed_manager.go of the component Distributed Manager. Such manipulation leads to denial of service. It is possible to launch the attack remotely. Upgrading to version 2.5.0 is sufficient to fix this issue. The name of the patch is 14e41a978b31e134ffa1170d8657f9dd98529aa3. Upgrading the affected component is advised.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact Low

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact None

Availability Impact Partial

This CVE is not in the KEV list.

Exploitation none

Automatable yes

Technical Impact partial

Affected Vendors & Products

Vendors Products
A2aproject
  • A2a-go

No data.

No data.

References
Link Providers
https://github.com/a2aproject/a2a-go/ cve-icon cve-icon
https://github.com/a2aproject/a2a-go/commit/14e41a978b31e134ffa1170d8657f9dd98529aa3 cve-icon cve-icon
https://github.com/a2aproject/a2a-go/pull/409 cve-icon cve-icon
https://github.com/a2aproject/a2a-go/releases/tag/v2.5.0 cve-icon cve-icon
https://vuldb.com/cve/CVE-2026-117504 cve-icon cve-icon
https://vuldb.com/submit/1015053 cve-icon cve-icon
https://vuldb.com/vuln/427071 cve-icon cve-icon
https://vuldb.com/vuln/427071/cti cve-icon cve-icon
History

Mon, 02 Nov 2026 20:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 27 Oct 2026 14:15:00 +0000

Type Values Removed Values Added
Description A vulnerability was identified in a2aproject a2a-go up to 2.4.0. The affected element is the function Cancel of the file internal/taskexec/distributed_manager.go of the component Distributed Manager. Such manipulation leads to denial of service. It is possible to launch the attack remotely. Upgrading to version 2.5.0 is sufficient to fix this issue. The name of the patch is 14e41a978b31e134ffa1170d8657f9dd98529aa3. Upgrading the affected component is advised.
Title a2aproject a2a-go Distributed Manager distributed_manager.go Cancel denial of service
First Time appeared A2aproject
A2aproject a2a-go
Weaknesses CWE-404
CPEs cpe:2.3:a:a2aproject:a2a-go:*:*:*:*:*:*:*:*
Vendors & Products A2aproject
A2aproject a2a-go
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:N/A:P/E:ND/RL:OF/RC:C'}

cvssV3_0

{'score': 5.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C'}

cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X'}
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published: 2026-10-27T14:00:17.060Z

Updated: 2026-11-02T19:19:32.173Z

Reserved: 2026-10-27T08:47:24.096Z

Link: CVE-2026-117504

cve-icon Vulnrichment

Updated: 2026-11-02T19:19:27.183Z

cve-icon NVD

Status : Deferred

Published: 2026-10-27T14:16:35.300

Modified: 2026-11-02T20:17:33.813

Link: CVE-2026-117504

cve-icon Redhat

No data.