---
id: CVE-2026-117506
title: >-
  a2aproject a2a-java Push Notification Config Store
  JpaDatabasePushNotificationConfigStore.java
  InMemoryPushNotificationConfigStore.setInfo resource consumption
summary: >-
  A weakness has been identified in a2aproject a2a-java up to 1.2.0.Final. This
  affects the function InMemoryPushNotificationConfigStore.setInfo of the file
  extras/push-notification-config-store-database-jpa/src/main/java/org/a2aproject/sd…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C'
cvssSource: cna
cwe:
  - CWE-400
  - CWE-404
vendor: a2aproject
product: a2a-java
affected:
  - a2a-java 1.2.0.Final
published: '2026-10-27'
updated: '2026-10-27'
sourceUpdated: '2026-10-27T14:45:14.820Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-117506'
references:
  - url: 'https://vuldb.com/vuln/427073'
    label: >-
      VDB-427073 | a2aproject a2a-java Push Notification Config Store
      JpaDatabasePushNotificationConfigStore.java
      InMemoryPushNotificationConfigStore.setInfo resource consumption
  - url: 'https://vuldb.com/vuln/427073/cti'
    label: 'VDB-427073 | CTI Indicators (IOB, IOC, TTP, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-117506'
    label: CVE-2026-117506 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1015055'
    label: 'Submit #1015055 | a2aproject a2a-java ≤ 1.2.0.Final CWE-400'
  - url: 'https://github.com/a2aproject/a2a-java/pull/1044'
  - url: >-
      https://github.com/a2aproject/a2a-java/commit/b478810a03b4a16841d36aca5c6e87d8f48fce67
  - url: 'https://github.com/a2aproject/a2a-java/releases/tag/v1.3.0.Final'
  - url: 'https://github.com/a2aproject/a2a-java/'
tags:
  - cve.org
ingestedAt: '2026-10-27T16:11:59.459Z'
---

## Overview

A weakness has been identified in a2aproject a2a-java up to 1.2.0.Final. This affects the function InMemoryPushNotificationConfigStore.setInfo of the file extras/push-notification-config-store-database-jpa/src/main/java/org/a2aproject/sdk/extras/pushnotificationconfigstore/database/jpa/JpaDatabasePushNotificationConfigStore.java of the component Push Notification Config Store. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. Upgrading to version 1.3.0.Final mitigates this issue. This patch is called b478810a03b4a16841d36aca5c6e87d8f48fce67. You should upgrade the affected component.

## Affected

- `a2a-java 1.2.0.Final`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.