GHSA-w333-36mh-cfv5MediumCVSS 4.3
A weakness has been identified in a2aproject a2a-java up to 1.2.0.Final. This affects the...
🔗 CVE IDs covered (1)
📋 Description
A weakness has been identified in a2aproject a2a-java up to 1.2.0.Final. This affects the function InMemoryPushNotificationConfigStore.setInfo of the file extras/push-notification-config-store-database-jpa/src/main/java/org/a2aproject/sdk/extras/pushnotificationconfigstore/database/jpa/JpaDatabasePushNotificationConfigStore.java of the component Push Notification Config Store. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. Upgrading to version 1.3.0.Final mitigates this issue. This patch is called b478810a03b4a16841d36aca5c6e87d8f48fce67. You should upgrade the affected component.
🔗 References (10)
- https://nvd.nist.gov/vuln/detail/CVE-2026-117506
- https://github.com/a2aproject/a2a-java/pull/1044
- https://github.com/a2aproject/a2a-java/commit/b478810a03b4a16841d36aca5c6e87d8f48fce67
- https://github.com/a2aproject/a2a-java
- https://github.com/a2aproject/a2a-java/releases/tag/v1.3.0.Final
- https://vuldb.com/cve/CVE-2026-117506
- https://vuldb.com/submit/1015055
- https://vuldb.com/vuln/427073
- https://vuldb.com/vuln/427073/cti
- https://github.com/advisories/GHSA-w333-36mh-cfv5