CVE-2026-117504 in a2a-go
Summary
by MITRE • 10/27/2026
A vulnerability was identified in a2aproject a2a-go up to 2.4.0. The affected element is the function Cancel of the file internal/taskexec/distributed_manager.go of the component Distributed Manager. Such manipulation leads to denial of service. It is possible to launch the attack remotely. Upgrading to version 2.5.0 is sufficient to fix this issue. The name of the patch is 14e41a978b31e134ffa1170d8657f9dd98529aa3. Upgrading the affected component is advised.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/27/2026
The a2aproject, specifically within its Go implementation known as a2a-go up to version 2.4.0, contains a critical vulnerability in the Distributed Manager component that can lead to denial of service conditions for remote attackers. This security flaw resides within the Cancel function located in the internal/taskexec/distributed_manager.go file. The nature of this vulnerability suggests an improper handling or logic error during the cancellation process of distributed tasks, which likely results in resource exhaustion, infinite loops, or state corruption that prevents further legitimate operations from being processed by the system.
From a technical perspective, the Distributed Manager is responsible for orchestrating and managing task execution across potentially multiple nodes or processes within a distributed architecture. When an attacker triggers the Cancel function through remote means, they can exploit the underlying logic flaw to destabilize the service. This could manifest as a complete halt in task processing, memory leaks that eventually crash the application, or deadlock scenarios where resources are held indefinitely without being released. Such behavior aligns with CWE-400, which describes conditions related to resource exhaustion, and potentially CWE-835 for loop errors involving infinite iterations if the cancellation logic fails to properly terminate ongoing operations.
The operational impact of this vulnerability is significant because it allows remote exploitation without requiring authentication in many configurations, depending on how the Distributed Manager exposes its interfaces. An attacker could send crafted requests that invoke the Cancel function with specific parameters or under certain timing conditions to trigger the denial of service state. This effectively disrupts availability for all users relying on the a2a-go services, leading to potential business interruption and loss of trust in the system's reliability. The ability to launch this attack remotely makes it particularly dangerous as it does not require physical access or prior compromise of other systems within the network perimeter.
To mitigate this risk, immediate action is required by upgrading the affected component to version 2.5.0 or later. This update includes a specific patch identified by the commit hash 14e41a978b31e134ffa1170d8657f9dd98529aa3, which addresses the logic errors in the Cancel function within distributed_manager.go. Organizations should verify their dependency management systems to ensure that a2a-go is updated across all environments where it is deployed. Additionally, implementing network-level controls such as rate limiting or input validation on endpoints exposing task cancellation functionality can provide an additional layer of defense against exploitation attempts while upgrades are being applied. Monitoring logs for unusual patterns in cancel requests may also help detect ongoing attacks during the remediation window.