Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-117503— a2aproject a2a-go REST SSE handler rest.go resource consumption

Quick assessment

Affected
a2aproject a2a-go
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 a2aproject 的 a2a-go 项目（版本 2.4.0 及以下）中发现了一个漏洞。该漏洞影响组件 REST SSE 处理器中文件 a2asrv/rest.go 的某个未知函数。攻击者可利用此漏洞引发资源消耗问题，且攻击可从远程发起。建议将组件升级至 2.5.0 版本以修复此问题。相关补丁编号为：ff6035bd21e44bb3ee1bfa547885b8c08327fa01。建议尽快升级受影响的组件。

CVSS 5.3 · Medium

Possible ATT&CK Techniques 1 AI

T1498 · Network Denial of Service
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-117503

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
a2aproject a2a-go REST SSE handler rest.go resource consumption
Source: CVE Program / CVE List V5
Vulnerability Description
A vulnerability was determined in a2aproject a2a-go up to 2.4.0. Impacted is an unknown function of the file a2asrv/rest.go of the component REST SSE handler. This manipulation causes resource consumption. It is possible to initiate the attack remotely. Upgrading to version 2.5.0 is recommended to address this issue. Patch name: ff6035bd21e44bb3ee1bfa547885b8c08327fa01. It is recommended to upgrade the affected component.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
a2aproject a2a-go 2.0 cpe:2.3:a:a2aproject:a2a-go:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-117503

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-117503

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-117503 (2)

Vendor Pages for CVE-2026-117503 (1)

Same Patch Batch · a2aproject · 2026-10-27 · 5 CVEs total

CVE-2026-117507 5.4 MEDIUM a2aproject a2a-java TaskManager.saveTaskEvent race condition
CVE-2026-117504 5.3 MEDIUM a2aproject a2a-go Distributed Manager distributed_manager.go Cancel denial of service
CVE-2026-117505 4.3 MEDIUM a2aproject a2a-java ChildQueue queue.offer resource consumption
CVE-2026-117506 4.3 MEDIUM a2aproject a2a-java Push Notification Config Store JpaDatabasePushNotificationConfigStore.

IV. Related Vulnerabilities

Same product: a2a-go
Same vendor: a2aproject
Same weakness: CWE-400