a2a-go CVE-2026-117503

Exploitation targets the REST SSE handler in a2asrv/rest.go (handleStreamingRequest) and requires a live server-sent-events subscription stream. The concrete condition shown by the regression test is a sequence: the client disconnects (cancelling the request context) so the main select loop returns, and the streaming/event-producing goroutine then panics - at which point the panic is sent on an unbuffered panicChan with no remaining reader, parking the goroutine indefinitely. Limiting factors: the leak only occurs when a panic happens in the streaming goroutine after disconnect, which is not purely attacker-controlled, and each event leaks resources incrementally rather than causing instant denial of service; no authentication is required per the CVSS vector (PR:N).

Signals point to a moderate, availability-only issue rather than an urgent priority. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 6.9 but carries impact only on VA:L - no confidentiality or integrity effect (VC:N/VI:N) - which matches CWE-400 resource consumption. The source diff confirms the mechanism: in a2asrv/rest.go the SSE streaming goroutine sends panics on an unbuffered panicChan, and the added regression test (TestSSE_PanicAfterClientDisconnectDoesNotLeak) shows that when the client disconnects the main select loop exits, leaving no reader; if the streaming goroutine then panics it blocks forever on the unread channel and leaks. The fix simply makes panicChan buffered (size 1) so the goroutine can exit. No EPSS score, KEV listing, or exploit PoC is present in the input, so there is no evidence of active exploitation; exploitation status is 'no public exploit identified at time of analysis'. One conflicting signal to note: the vendor rates AC:L, but the regression test shows exploitation requires the streaming goroutine to panic AFTER a client disconnect - a condition not fully attacker-controlled - so real-world triggerability is lower than AC:L implies. The vuln.today decision label is 'this_month', consistent with a patch-on-normal-cadence item rather than an emergency.

A remote client opens a REST SSE subscription (e.g. /tasks/{id}:subscribe) against an a2a-go server and then disconnects while the stream is active, causing the handler's select loop to return. If the backing event-producing goroutine subsequently panics, it attempts to report the panic on an unbuffered channel that now has no reader, so the goroutine blocks permanently and leaks; repeated occurrences accumulate leaked goroutines and memory until availability degrades. No public PoC or exploit code is referenced in the input.