a2a-java CVE-2026-117505

Requires a running a2a-java server (version ≤ 1.2.0.Final) exposing the streaming event-consumer path that uses ChildQueue, reachable over the network. Per the CVSS vector (PR:L) the attacker needs low-level authenticated access sufficient to establish a task/event subscription and drive event enqueuing. Exploitation hinges on a slow or stalled subscriber so that the previously unbounded ChildQueue deque grows faster than it is drained, consuming memory. Limiting factors: authentication is required (not anonymous), impact is confined to availability at a low level (VA:L, no data compromise), and the growth is per-task/child queue rather than a single trivial request; the trigger relies on sustained enqueuing against a non-draining consumer rather than one crafted packet.

This is a moderate, low-urgency availability issue, not a high-priority emergency. The CVSS 4.0 base score is 5.3 (MEDIUM) with vector AV:N/AC:L/PR:L/UI:N and only VA:L - a low, partial availability impact and no confidentiality or integrity impact. The attack is network-reachable and low-complexity, but PR:L means an attacker needs at least low-level authenticated access to the A2A server (ability to open a task/streaming session and enqueue events), which limits the exposed population to clients already permitted to interact with the agent. There is no CISA KEV listing, no EPSS score was provided, and the input does not mark any confirmed public exploit; the vuln.today decision label is 'this_month' (routine patching cadence), consistent with a real but non-critical bug. The source diff corroborates the mechanism: ChildQueue previously used an unbounded LinkedBlockingDeque, so a slow or stalled subscriber could let the per-task queue grow without bound and consume memory (CWE-400). Signals are internally consistent - there is no conflict between the vector and the description. Bottom line: a legitimate hardening priority to schedule in normal patching, not a drop-everything issue; the main caveat is that EPSS/KEV/PoC signals are simply absent rather than confirmed-negative, so real-world exploitation interest cannot be ruled in or out from this data.

An authenticated client of an a2a-java server opens a streaming task/event subscription and then consumes events slowly or not at all while events continue to be enqueued. Because the ChildQueue's backing deque is unbounded in versions up to 1.2.0.Final, the queue grows without limit and consumes JVM heap, degrading or disrupting the service. No confirmed public exploit code is identified in the provided data; the mechanism is derived from the vendor patch diff.