a2aproject a2a-java Push Notification Config Store JpaDatabasePushNotificationConfigStore.java InMemoryPushNotificationConfigStore.setInfo resource consumption
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fix or patch referenced
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The a2a-java software project's Push Notification Config Store component, which handles push notification configuration storage (including its JPA database and in-memory store implementations), is affected. A remote attacker can manipulate it to consume excessive system resources, potentially degrading or disrupting the service.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
A weakness has been identified in a2aproject a2a-java up to 1.2.0.Final. This affects the function InMemoryPushNotificationConfigStore.setInfo of the file extras/push-notification-config-store-database-jpa/src/main/java/org/a2aproject/sdk/extras/pushnotificationconfigstore/database/jpa/JpaDatabasePushNotificationConfigStore.java of the component Push Notification Config Store. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. Upgrading to version 1.3.0.Final mitigates this issue. This patch is called b478810a03b4a16841d36aca5c6e87d8f48fce67. You should upgrade the affected component.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- a2aproject a2a-java
1.2.0.Final