A2A Go
Monthly
Resource exhaustion in the a2a-go A2A SDK (versions 2.0 through 2.4.0) allows an unauthenticated remote client to leave server goroutines permanently parked in the REST server-sent-events streaming handler. The trigger shown by the vendor's regression test is a sequence rather than a single packet: the client disconnects, the main select loop in handleStreamingRequest returns, and the event-producing goroutine then panics and blocks forever trying to send on a panic channel that no longer has a reader. Impact is availability-only and incremental - each occurrence leaks resources instead of causing instant denial of service - no public exploit code was identified at time of analysis, and the vendor has released a fix in v2.5.0.
Information exposure in the a2a-go SDK for the A2A protocol (versions up to and including 2.4.0) causes push notification configuration data to be written into an error message returned by factory.CreateExecutor in a2asrv/agentexec.go. The leak only occurs when saving the push configuration fails, at which point the pre-patch code interpolated the entire params.Config.PushConfig structure into the returned error, exposing callback/webhook details to the remote caller; the assessed impact is confidentiality-only (C:L) with no integrity or availability effect, reachable remotely with no authentication or user interaction required per the CVSS vector. No public exploit code or PoC is identified in the supplied sources and the issue is not in CISA KEV; the vendor fix is a2a-go v2.5.0 (PR #393, commit f4d5882).
Resource exhaustion in the a2a-go A2A SDK (versions 2.0 through 2.4.0) allows an unauthenticated remote client to leave server goroutines permanently parked in the REST server-sent-events streaming handler. The trigger shown by the vendor's regression test is a sequence rather than a single packet: the client disconnects, the main select loop in handleStreamingRequest returns, and the event-producing goroutine then panics and blocks forever trying to send on a panic channel that no longer has a reader. Impact is availability-only and incremental - each occurrence leaks resources instead of causing instant denial of service - no public exploit code was identified at time of analysis, and the vendor has released a fix in v2.5.0.
Information exposure in the a2a-go SDK for the A2A protocol (versions up to and including 2.4.0) causes push notification configuration data to be written into an error message returned by factory.CreateExecutor in a2asrv/agentexec.go. The leak only occurs when saving the push configuration fails, at which point the pre-patch code interpolated the entire params.Config.PushConfig structure into the returned error, exposing callback/webhook details to the remote caller; the assessed impact is confidentiality-only (C:L) with no integrity or availability effect, reachable remotely with no authentication or user interaction required per the CVSS vector. No public exploit code or PoC is identified in the supplied sources and the issue is not in CISA KEV; the vendor fix is a2a-go v2.5.0 (PR #393, commit f4d5882).