Description
A security flaw has been discovered in a2aproject a2a-java up to 1.2.0.Final. The impacted element is the function queue.offer of the component ChildQueue. Performing a manipulation results in resource consumption. The attack can be initiated remotely. Upgrading to version 1.3.0.Final is sufficient to resolve this issue. The patch is named be663f806efcfdddd2805d214fae4998379ac5f2. It is advisable to upgrade the affected component.
Published: 2026-10-27
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Denial of Service via resource consumption
Action: Update Component
AI Analysis

Impact

A manipulation of the queue.offer function in the ChildQueue component can cause uncontrolled resource consumption, resulting in degraded performance or a denial of service. This flaw falls under CWE-400 and CWE-404. The impact is limited to the application’s resources and can affect all users with access to the exposed interface.

Affected Systems

The vulnerability affects a2aproject a2a-java versions up to 1.2.0.Final. Users running any of those releases should upgrade to 1.3.0.Final or later to remove the flaw. The product is a2aproject’s a2a-java, an integration framework for messaging.

Risk and Exploitability

The CVSS score of 5.3 places this flaw in the moderate severity range. While the EPSS score is not available, the flaw can be triggered from a remote attacker who can manipulate the queue.offer operation. The flaw is not listed in the CISA KEV catalog, suggesting no publicly known exploits at the time of analysis. Nevertheless, the remote nature of the attack vector and the resource consumption impact warrant timely remediation.

Generated by OpenCVE AI on October 27, 2026 at 15:20 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade a2a-java to version 1.3.0.Final or later
  • If an immediate upgrade is not feasible, restrict network access to the component’s queue.offer interface or disable the API that allows manipulation of the ChildQueue
  • Implement application‑level resource limits or rate‑limiting to mitigate potential overconsumption attacks

Generated by OpenCVE AI on October 27, 2026 at 15:20 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 14:45:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in a2aproject a2a-java up to 1.2.0.Final. The impacted element is the function queue.offer of the component ChildQueue. Performing a manipulation results in resource consumption. The attack can be initiated remotely. Upgrading to version 1.3.0.Final is sufficient to resolve this issue. The patch is named be663f806efcfdddd2805d214fae4998379ac5f2. It is advisable to upgrade the affected component.
Title a2aproject a2a-java ChildQueue queue.offer resource consumption
First Time appeared A2aproject
A2aproject a2a-java
Weaknesses CWE-400
CWE-404
CPEs cpe:2.3:a:a2aproject:a2a-java:*:*:*:*:*:*:*:*
Vendors & Products A2aproject
A2aproject a2a-java
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:N/A:P/E:ND/RL:OF/RC:C'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X'}

Subscriptions

A2aproject A2a-java
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-27T14:30:19.859Z

Reserved: 2026-10-27T08:47:27.710Z

Link: CVE-2026-117505

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-27T15:16:57.287

Modified: 2026-10-27T15:55:51.450

Link: CVE-2026-117505

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T15:45:04Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-404

    Improper Resource Shutdown or Release