# CVE-2026-117503: a2aproject a2a-go resource exhaustion in REST SSE handler

Source: https://junglewise.ai/threats/cve-2026-117503-a-vulnerability-was-determined-in-a2aproject-a2a-go-up-to-2-4-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-117503 · Severity: medium · CVSS 5.3 · Published 2026-10-27

a2a-go is a Golang SDK for the A2A Protocol, used in agent-to-agent communication systems. A resource exhaustion vulnerability in the REST Server-Sent Events (SSE) handler can cause goroutine leaks when clients disconnect unexpectedly, potentially leading to memory exhaustion and service degradation. The vulnerability affects versions up to 2.4.0 and is fixed in version 2.5.0.

Technologies: [A2aproject A2a-Go](https://junglewise.ai/threats/technologies/a2a-go). Vendors: [A2aproject](https://junglewise.ai/threats/vendors/a2aproject).

## Quick answers

**Is CVE-2026-117503 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-117503 being exploited in the wild.

**How severe is CVE-2026-117503?** Medium severity, with a CVSS score of 5.3, published 27 October 2026.

**Which products and versions are affected?** A2aproject A2a-Go up to 2.4.0.

**Is there a fix for CVE-2026-117503?** Yes: fixed in 2.5.0. Until then: Upgrade to version 2.5.0 or apply the fix from commit ff6035bd21e44bb3ee1bfa547885b8c08327fa01. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-117503 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-117503?** Check whether you run A2aproject A2a-Go at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2.5.0

Upgrade to version 2.5.0 or apply the fix from commit ff6035bd21e44bb3ee1bfa547885b8c08327fa01.

## Technical details

The vulnerability exists in the REST SSE handler (a2asrv/rest.go) where an unbuffered panicChan channel causes goroutine leaks when a streaming goroutine panics after the client has disconnected. The main loop exits via requestCtx.Done() without reading from panicChan, causing the goroutine to block forever when attempting to write the panic value. The fix buffers panicChan with capacity 1 and guards the panic write with a select on requestCtx.Done() to allow early exit. Remote attack is possible without authentication requirements.

## Affected products

- a2aproject a2a-go up to 2.4.0

## Timeline

- 2026-10-27: disclosed
- 2026-08-18: patched: Fix commit ff6035bd21e44bb3ee1bfa547885b8c08327fa01

## References

- [https://github.com/a2aproject/a2a-go/](https://github.com/a2aproject/a2a-go/)
- [https://github.com/a2aproject/a2a-go/commit/ff6035bd21e44bb3ee1bfa547885b8c08327fa01](https://github.com/a2aproject/a2a-go/commit/ff6035bd21e44bb3ee1bfa547885b8c08327fa01)

## Related threats

- [a2aproject a2a-go denial of service in Distributed Manager Cancel](https://junglewise.ai/threats/cve-2026-117504-a-vulnerability-was-identified-in-a2aproject-a2a-go-up-to-2-4-0)
- [a2a-go information exposure through error message in CreateExecutor](https://junglewise.ai/threats/cve-2026-116478-a-vulnerability-was-detected-in-a2aproject-a2a-go-up-to-2-4-0)