A weakness has been identified in a2aproject a2a-java up to 1.2.0.Final. This affects the function InMemoryPushNotificationConfigStore.setInfo of the file extras/push-notification-config-store-database-jpa/src/main/java/org/a2aproject/sdk/extras/pushnotificationconfigstore/database/jpa/JpaDatabasePushNotificationConfigStore.java of the component Push Notification Config Store. Executing a manipulation can lead to resource consumption.
The attack can be launched remotely. Upgrading to version 1.3.0.Final mitigates this issue. This patch is called b478810a03b4a16841d36aca5c6e87d8f48fce67.
You should upgrade the affected component.
Attack Parameters
Attack Vector
Network
Can be exploited remotely
Attack Complexity
Low
Easy to exploit
Attack Requirements
None
No additional conditions
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
None
No data leak
Integrity
None
No data modification
Availability
Low
Partial disruption
CVSS Vector v4.0
Weakness Type (CWE)
Vulnerable Products
a2aproject:a2a-java
References 8
https://github.com/a2aproject/a2a-java/
cna@vuldb.com
https://github.com/a2aproject/a2a-java/commit/b478810a03b4a16841d36aca5c6e87d8f…
cna@vuldb.com
https://github.com/a2aproject/a2a-java/pull/1044
cna@vuldb.com
https://github.com/a2aproject/a2a-java/releases/tag/v1.3.0.Final
cna@vuldb.com
https://vuldb.com/cve/CVE-2026-117506
cna@vuldb.com
https://vuldb.com/submit/1015055
cna@vuldb.com
https://vuldb.com/vuln/427073
cna@vuldb.com
https://vuldb.com/vuln/427073/cti
cna@vuldb.com