CVE-2026-117503
Medium · 5.3CVSS
5.3
EPSS
0.7%
Published
Oct 27, 2026
CISA due date
—
The record
A vulnerability was determined in a2aproject a2a-go up to 2.4.0. Impacted is an unknown function of the file a2asrv/rest.go of the component REST SSE handler. This manipulation causes resource consumption. It is possible to initiate the attack remotely. Upgrading to version 2.5.0 is recommended to address this issue. Patch name: ff6035bd21e44bb3ee1bfa547885b8c08327fa01. It is recommended to upgrade the affected component.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-63341 Aedes is an MQTT broker that can run on any stream server. CWE-400
- CVE-2026-62300 Filecoin Pin is an IPFS Pinning Service API implementation that pins to Filecoin's PDP… CWE-400
- CVE-2026-62254 LibreDWG is a free C library to read and write DWG files. CWE-400
- CVE-2026-62250 LibreDWG is a free C library to read and write DWG files. CWE-400
- CVE-2026-62303 Pistache is a high-performance REST toolkit written in C++. CWE-400
- CVE-2026-62160 Daptin is a GraphQL/JSON-API headless CMS. CWE-400
- CVE-2026-61848 Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3… CWE-400
- CVE-2026-61854 VoiceSentinel is a real-time voice moderation system for Minecraft servers. CWE-400