VulnerabilityDeferred
CVE-2026-117507
A security vulnerability has been detected in a2aproject a2a-java up to 1.2.0.Final.
MEDIUM 5.3EPSS —
Does this matter?
Lower severity and no EPSS score yet. Track it; it rarely justifies an emergency change on its own.
Description
A security vulnerability has been detected in a2aproject a2a-java up to 1.2.0.Final. This impacts the function TaskManager.saveTaskEvent. The manipulation leads to race condition. The attack may be initiated remotely. Upgrading to version 1.3.0.Final will fix this issue. The identifier of the patch is 6b8e1e085c35e970ef0048901cd25850e4791ec2. The affected component should be upgraded.
- CVSS 4.0
- 5.3 MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- No score yet
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-362
- Source
- cna@vuldb.com
References
- https://github.com/a2aproject/a2a-java/
- https://github.com/a2aproject/a2a-java/commit/6b8e1e085c35e970ef0048901cd25850e4791ec2
- https://github.com/a2aproject/a2a-java/pull/1045
- https://github.com/a2aproject/a2a-java/releases/tag/v1.3.0.Final
- https://vuldb.com/cve/CVE-2026-117507
- https://vuldb.com/submit/1015060
- https://vuldb.com/vuln/427074
- https://vuldb.com/vuln/427074/cti
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.