CVE-2026-117505Medium· 4.3▾ SunlitA security flaw has been discovered in a2aproject a2a-java up to 1.2.0.Final. The impacted element is the function queue.offer of the component ChildQueue. Performing a manipulation results in resource consumption. The attack can be init…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 28.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.3%
A security flaw has been discovered in a2aproject a2a-java up to 1.2.0.Final. The impacted element is the function queue.offer of the component ChildQueue. Performing a manipulation results in resource consumption. The attack can be initiated remotely. Upgrading to version 1.3.0.Final is sufficient to resolve this issue. The patch is named be663f806efcfdddd2805d214fae4998379ac5f2. It is advisable to upgrade the affected component.
a2a-java 1.2.0.FinalRefer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-117506Medium· 4.3a2aproject a2a-java Push Notification Config Store JpaDatabasePushNotificationConfigStore.java InMemoryPushNotificationConfigStore.setInfo resource consumption
CVE-2026-117507Medium· 5.4a2aproject a2a-java TaskManager.saveTaskEvent race condition
CVE-2026-116479Medium· 4.3a2aproject a2a-java JSON-RPC Error getMessage information exposure
CVE-2026-90819High· 7.3A weakness has been identified in a2aproject a2a-java 1.2.0
CVE-2026-90820Medium· 4.3A security vulnerability has been detected in a2aproject a2a-java 1.2.0
CVE-2026-117503Medium· 5.3a2aproject a2a-go REST SSE handler rest.go resource consumption