CVE-2026-117504: a2aproject a2a-go Distributed Manager distributed_manager.go Cancel denial of service
A vulnerability was identified in a2aproject a2a-go up to 2.4.0. The affected element is the function Cancel of the file internal/taskexec/distributedmanager.go of the component Distributed Manager. Such manipulation leads to denial of service. It is possible to launch the attack remotely. Upgrading to version 2.5.0 is sufficient to fix this issue. The name of the patch is 14e41a978b31e134ffa1170d8657f9dd98529aa3. Upgrading the affected component is advised.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
a2aproject/a2a-goto a version that resolves this vulnerability.Fixed in 2.5.0Patch 14e41a978b31e134ffa1170d8657f9dd98529aa3
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using a2aproject a2a-go versions up to and including 2.4.0 are affected when they use the Distributed Manager component.
Does exploitation require authentication or user interaction?
No. The available severity vector indicates network access, low attack complexity, no privileges required, and no user interaction.
What is the impact of successful exploitation?
Successful manipulation of the Distributed Manager Cancel function can cause a denial of service. The reported impact is limited to availability; no confidentiality or integrity impact is indicated.
What remediation is available?
Upgrade a2aproject a2a-go to version 2.5.0. The reported fix is associated with patch 14e41a978b31e134ffa1170d8657f9dd98529aa3.