CVE-2026-117506: a2aproject a2a-java Push Notification Config Store JpaDatabasePushNotificationConfigStore.java InMemoryPushNotificationConfigStore.setInfo resource consumption
A weakness has been identified in a2aproject a2a-java up to 1.2.0.Final. This affects the function InMemoryPushNotificationConfigStore.setInfo of the file extras/push-notification-config-store-database-jpa/src/main/java/org/a2aproject/sdk/extras/pushnotificationconfigstore/database/jpa/JpaDatabasePushNotificationConfigStore.java of the component Push Notification Config Store. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. Upgrading to version 1.3.0.Final mitigates this issue. This patch is called b478810a03b4a16841d36aca5c6e87d8f48fce67. You should upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
a2aproject/a2a-javato a version that resolves this vulnerability.Fixed in 1.3.0.FinalPatch b478810a03b4a16841d36aca5c6e87d8f48fce67
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using the Push Notification Config Store component in a2a-java versions up to 1.2.0.Final are affected, specifically the JpaDatabasePushNotificationConfigStore implementation containing InMemoryPushNotificationConfigStore.setInfo.
What access does an attacker need?
The issue can be exploited remotely and requires low privileges. No user interaction is required.
What is the impact of exploitation?
An attacker can manipulate the affected function to cause resource consumption, resulting in an availability impact.
How should this be remediated?
Upgrade the affected component to a2a-java version 1.3.0.Final. The remediation is associated with patch b478810a03b4a16841d36aca5c6e87d8f48fce67.