CVE-2026-117506 PUBLISHED

A weakness has been identified in a2aproject a2a-java up to 1.2.0.Final. This affects the function InMemoryPushNotificationConfigStore.setInfo of the file extras/push-notification-config-store-database-jpa/src/main/java/org/a2aproject/sdk/extras/pushnotificationconfigstore/database/jpa/JpaDatabasePushNotificationConfigStore.java of the component Push Notification Config Store. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. Upgrading to version 1.3.0.Final mitigates this issue. This patch is called b478810a03b4a16841d36aca5c6e87d8f48fce67. You should upgrade the affected component.

• colorfullbz (VulDB User) reporter

• VDB-427073 | a2aproject a2a-java Push Notification Config Store JpaDatabasePushNotificationConfigStore.java InMemoryPushNotificationConfigStore.setInfo resource consumption
• VDB-427073 | CTI Indicators (IOB, IOC, TTP, IOA)
• CVE-2026-117506 | CVE Analysis and Report
• Submit #1015055 | a2aproject a2a-java ≤ 1.2.0.Final CWE-400
• https://github.com/a2aproject/a2a-java/pull/1044
• https://github.com/a2aproject/a2a-java/commit/b478810a03b4a16841d36aca5c6e87d8f48fce67
• https://github.com/a2aproject/a2a-java/releases/tag/v1.3.0.Final
• https://github.com/a2aproject/a2a-java/

• Resource Consumption CWE
• Denial of Service CWE