TI-2026-81183 Aliases CVE-2026-117503 GHSA-cpqw-hg34-p3wx

Resource consumption in a2aproject a2a-go REST SSE handler

LOW 38CWE-400Published 2026-10-27 · Updated 2026-11-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · Low
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

A flaw in the REST SSE handler in a2asrv/rest.go of a2aproject a2a-go versions 2.0 through 2.4.0 causes uncontrolled resource consumption. A remote attacker needs no privileges or user interaction to trigger it, with a low impact on availability. The flaw is classified as CWE-400 and CWE-404.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Description from the CNA

A vulnerability was determined in a2aproject a2a-go up to 2.4.0. Impacted is an unknown function of the file a2asrv/rest.go of the component REST SSE handler. This manipulation causes resource consumption. It is possible to initiate the attack remotely. Upgrading to version 2.5.0 is recommended to address this issue. Patch name: ff6035bd21e44bb3ee1bfa547885b8c08327fa01. It is recommended to upgrade the affected component.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0071 53rd percentileScored 2026-11-07

Fix Fixed a2a-go (a2aproject): 2.5.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
a2aproject	a2a-go	2.0; 2.1; 2.2; 2.3; 2.4.0	2.5.0	Patch available	CNA

a2a-go Vendora2aproject Affected 2.0; 2.1; 2.2; 2.3; 2.4.0 Fixed in 2.5.0 Patch available CNA

CPE names CNA · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:a2aproject:a2a-go::::::::	—	—	a2aproject

cpe:2.3:a:a2aproject:a2a-go:*:*:*:*:*:*:*:* Versions — — ·a2aproject

Remediation

Upgrade a2aproject a2a-go to version 2.5.0, which contains the fix (patch ff6035bd21e44bb3ee1bfa547885b8c08327fa01).

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Fix · CNA a2a-go (a2aproject) Fixed in 2.5.0

Timeline

2026-10-27 Threatist record created from CVE-2026-117503
2026-10-27 Alias added: GHSA-cpqw-hg34-p3wx
2026-10-28 Priority changed: MEDIUM → LOW
2026-11-02 CISA SSVC decision points changed

References

Patch 3

Other 1

https://github.com/a2aproject/a2a-go/

TI-2026-76905 Android A2A Java SDK forwards API keys across redirects CVSS 3.1HIGH 7.5
TI-2026-76904 A2A Java SDK default task store skips authorization on task reads CVSS 3.1HIGH 7.5
TI-2026-76847 Server-side request forgery in A2A Java SDK push notifications CVSS 3.1MEDIUM 5.8
TI-2026-61722 HTTP response splitting in a2aproject a2a-java CVSS 4.0MEDIUM 6.9
TI-2026-81185 Denial of service in a2aproject a2a-go Distributed Manager Cancel CVSS 4.0MEDIUM 6.9
TI-2026-80567 Error message leaks sensitive information in a2a-go CreateExecutor CVSS 4.0MEDIUM 6.9

See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences