{"id":"CVE-2026-117506","published":"2026-10-27T15:16:57.467","lastModified":"2026-10-27T15:55:51.450","description":"A weakness has been identified in a2aproject a2a-java up to 1.2.0.Final. This affects the function InMemoryPushNotificationConfigStore.setInfo of the file extras/push-notification-config-store-database-jpa/src/main/java/org/a2aproject/sdk/extras/pushnotificationconfigstore/database/jpa/JpaDatabasePushNotificationConfigStore.java of the component Push Notification Config Store. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. Upgrading to version 1.3.0.Final mitigates this issue. This patch is called b478810a03b4a16841d36aca5c6e87d8f48fce67. You should upgrade the affected component.","cvssScore":4.3,"cvssSeverity":"MEDIUM","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","cwes":["CWE-400","CWE-404"],"vendors":[],"products":[],"references":[{"url":"https://github.com/a2aproject/a2a-java/","tags":[]},{"url":"https://github.com/a2aproject/a2a-java/commit/b478810a03b4a16841d36aca5c6e87d8f48fce67","tags":[]},{"url":"https://github.com/a2aproject/a2a-java/pull/1044","tags":[]},{"url":"https://github.com/a2aproject/a2a-java/releases/tag/v1.3.0.Final","tags":[]},{"url":"https://vuldb.com/cve/CVE-2026-117506","tags":[]},{"url":"https://vuldb.com/submit/1015055","tags":[]},{"url":"https://vuldb.com/vuln/427073","tags":[]},{"url":"https://vuldb.com/vuln/427073/cti","tags":[]}],"exploitRefs":[{"url":"https://github.com/a2aproject/a2a-java/","tags":[]},{"url":"https://github.com/a2aproject/a2a-java/commit/b478810a03b4a16841d36aca5c6e87d8f48fce67","tags":[]},{"url":"https://github.com/a2aproject/a2a-java/pull/1044","tags":[]},{"url":"https://github.com/a2aproject/a2a-java/releases/tag/v1.3.0.Final","tags":[]}],"hasPoc":true,"ai":null}