Description
A weakness has been identified in a2aproject a2a-java up to 1.2.0.Final. This affects the function InMemoryPushNotificationConfigStore.setInfo of the file extras/push-notification-config-store-database-jpa/src/main/java/org/a2aproject/sdk/extras/pushnotificationconfigstore/database/jpa/JpaDatabasePushNotificationConfigStore.java of the component Push Notification Config Store. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. Upgrading to version 1.3.0.Final mitigates this issue. This patch is called b478810a03b4a16841d36aca5c6e87d8f48fce67. You should upgrade the affected component.
Published: 2026-10-27
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Denial of Service due to Resource Consumption
Action: Patch
AI Analysis

Impact

A vulnerability exists in the a2aproject a2a-java component where the method InMemoryPushNotificationConfigStore.setInfo can be manipulated to consume excessive system resources, potentially exhausting memory or processing capacity. The flaw represents Uncontrolled Resource Consumption (CWE‑400) and Improper Resource Shutdown or Release (CWE‑404), and can lead to denial of service for the affected application.

Affected Systems

Versions of a2a-java up to and including 1.2.0.Final contain the vulnerable method. The vendor a2aproject releases the patched a2a-java with version 1.3.0.Final, which removes the insecure implementation.

Risk and Exploitability

The CVSS score of 5.3 denotes moderate severity. EPSS data is not available, but the patch notes state that the attack can be launched remotely, implying an attacker can craft requests to trigger resource exhaustion. The vulnerability is not listed in the CISA KEV catalog, suggesting no publicly known exploits yet, but the potential for denial of service remains.

Generated by OpenCVE AI on October 27, 2026 at 17:09 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade a2a-java to version 1.3.0.Final or later to eliminate the vulnerable method.
  • If an immediate upgrade is impossible, isolate the application process and enforce strict resource limits (memory, CPU) to constrain potential exhaustion.
  • Monitor memory and CPU usage on the affected services, and configure alerts for abnormal spikes that may indicate manipulation attempts.

Generated by OpenCVE AI on October 27, 2026 at 17:09 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 15:00:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in a2aproject a2a-java up to 1.2.0.Final. This affects the function InMemoryPushNotificationConfigStore.setInfo of the file extras/push-notification-config-store-database-jpa/src/main/java/org/a2aproject/sdk/extras/pushnotificationconfigstore/database/jpa/JpaDatabasePushNotificationConfigStore.java of the component Push Notification Config Store. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. Upgrading to version 1.3.0.Final mitigates this issue. This patch is called b478810a03b4a16841d36aca5c6e87d8f48fce67. You should upgrade the affected component.
Title a2aproject a2a-java Push Notification Config Store JpaDatabasePushNotificationConfigStore.java InMemoryPushNotificationConfigStore.setInfo resource consumption
First Time appeared A2aproject
A2aproject a2a-java
Weaknesses CWE-400
CWE-404
CPEs cpe:2.3:a:a2aproject:a2a-java:*:*:*:*:*:*:*:*
Vendors & Products A2aproject
A2aproject a2a-java
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:N/A:P/E:ND/RL:OF/RC:C'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X'}

Subscriptions

A2aproject A2a-java
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-27T14:45:14.820Z

Reserved: 2026-10-27T08:47:31.249Z

Link: CVE-2026-117506

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-27T15:16:57.467

Modified: 2026-10-27T15:55:51.450

Link: CVE-2026-117506

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-27T18:00:07Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-404

    Improper Resource Shutdown or Release