{"id":"CVE-2026-117506","title":"a2aproject a2a-java Push Notification Config Store JpaDatabasePushNotificationConfigStore.java InMemoryPushNotificationConfigStore.setInfo resource consumption","summary":"A weakness has been identified in a2aproject a2a-java up to 1.2.0.Final. This affects the function InMemoryPushNotificationConfigStore.setInfo of the file extras/push-notification-config-store-database-jpa/src/main/java/org/a2aproject/sd…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C","cvssSource":"cna","cwe":["CWE-400","CWE-404"],"vendor":"a2aproject","product":"a2a-java","affected":["a2a-java 1.2.0.Final"],"published":"2026-10-27","updated":"2026-10-27","sourceUpdated":"2026-10-27T14:45:14.820Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-117506","references":[{"url":"https://vuldb.com/vuln/427073","label":"VDB-427073 | a2aproject a2a-java Push Notification Config Store JpaDatabasePushNotificationConfigStore.java InMemoryPushNotificationConfigStore.setInfo resource consumption"},{"url":"https://vuldb.com/vuln/427073/cti","label":"VDB-427073 | CTI Indicators (IOB, IOC, TTP, IOA)"},{"url":"https://vuldb.com/cve/CVE-2026-117506","label":"CVE-2026-117506 | CVE Analysis and Report"},{"url":"https://vuldb.com/submit/1015055","label":"Submit #1015055 | a2aproject a2a-java ≤ 1.2.0.Final CWE-400"},{"url":"https://github.com/a2aproject/a2a-java/pull/1044"},{"url":"https://github.com/a2aproject/a2a-java/commit/b478810a03b4a16841d36aca5c6e87d8f48fce67"},{"url":"https://github.com/a2aproject/a2a-java/releases/tag/v1.3.0.Final"},{"url":"https://github.com/a2aproject/a2a-java/"}],"tags":["cve.org"],"ingestedAt":"2026-10-27T16:11:59.459Z","slug":"CVE-2026-117506","body":"## Overview\n\nA weakness has been identified in a2aproject a2a-java up to 1.2.0.Final. This affects the function InMemoryPushNotificationConfigStore.setInfo of the file extras/push-notification-config-store-database-jpa/src/main/java/org/a2aproject/sdk/extras/pushnotificationconfigstore/database/jpa/JpaDatabasePushNotificationConfigStore.java of the component Push Notification Config Store. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. Upgrading to version 1.3.0.Final mitigates this issue. This patch is called b478810a03b4a16841d36aca5c6e87d8f48fce67. You should upgrade the affected component.\n\n## Affected\n\n- `a2a-java 1.2.0.Final`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}