{"schema":"threatline.record/2","record":{"id":"CVE-2026-117503","aliases":[],"summary":"a2aproject a2a-go REST SSE handler rest.go resource consumption","details":"A vulnerability was determined in a2aproject a2a-go up to 2.4.0. Impacted is an unknown function of the file a2asrv/rest.go of the component REST SSE handler. This manipulation causes resource consumption. It is possible to initiate the attack remotely. Upgrading to version 2.5.0 is recommended to address this issue. Patch name: ff6035bd21e44bb3ee1bfa547885b8c08327fa01. It is recommended to upgrade the affected component.","categories":["Unclassified"],"product":"a2a-go","vendor":"a2aproject","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-117503","source_modified_at":"2026-10-27T13:45:17.953Z","fetched_at":"2026-10-27T16:27:21.584480Z","product":"a2a-go","vendor":"a2aproject","versions":[{"version":"2.0","status":"affected"},{"version":"2.1","status":"affected"},{"version":"2.2","status":"affected"},{"version":"2.3","status":"affected"},{"version":"2.4.0","status":"affected"},{"version":"2.5.0","status":"unaffected"}],"defaultStatus":null}],"fixed_versions":[],"cvss":6.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-27T13:45:17.953Z","modified_at":"2026-10-27T13:45:17.953Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-117503","fetched_at":"2026-10-27T16:27:21.584480Z","source_modified_at":"2026-10-27T13:45:17.953Z"}],"sources":["CVE List"],"references":[{"source":"CVE List","url":"https://vuldb.com/vuln/427070","tags":["vdb-entry"]},{"source":"CVE List","url":"https://vuldb.com/vuln/427070/cti","tags":["signature","permissions-required"]},{"source":"CVE List","url":"https://vuldb.com/cve/CVE-2026-117503","tags":["third-party-advisory"]},{"source":"CVE List","url":"https://vuldb.com/submit/1015052","tags":["third-party-advisory"]},{"source":"CVE List","url":"https://github.com/a2aproject/a2a-go/pull/396","tags":["issue-tracking","patch"]},{"source":"CVE List","url":"https://github.com/a2aproject/a2a-go/commit/ff6035bd21e44bb3ee1bfa547885b8c08327fa01","tags":["patch"]},{"source":"CVE List","url":"https://github.com/a2aproject/a2a-go/releases/tag/v2.5.0","tags":["patch"]},{"source":"CVE List","url":"https://github.com/a2aproject/a2a-go/","tags":["product"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-10-27T13:45:17.953Z","content_hash":"419ea6e57885d89b6cecf8aaf2715d3d142ab9d1b17764404bce88a059bb044e"}}