CVE-2026-113704
HighCVSS 7.3Summary
In a2aproject a2a-rs up to 0.4.3, the HttpPushSender function in crates/server/src/push_notification_sender.rs (Push Notification Handler component) allows manipulation of the TaskPushNotificationConfig argument, leading to server-side request forgery. The attack may be launched remotely, and the patch is commit 2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224.
Risk Assessment
A remote attacker can force the server to make requests to internal resources, potentially leading to data leakage or access to internal services.
Recommendation
Apply the patch from commit 2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224 or update a2a-rs to a version containing this fix.
Other vulnerabilities in a2a-rs
See all- CVE-2026-113707Medium
A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the file a2a-server/src/task_store/inmemory.rs. The manipulation results in race condition. The attack may be performed from remote. The patch is identified as 7050c7d329238539424ee46440e23b91c4825bee.
- CVE-2026-113706Low
A vulnerability was identified in a2aproject a2a-rs up to 0.4.3. Impacted is an unknown function of the file a2a-server/src/task_store/inmemory.rs. The manipulation of the argument historyLength leads to information disclosure. The attack is possible to be carried out remotely. The identifier of the patch is 68f1b7e772ae5d6c9e581ac9b48bcddd10fe70eb. To fix this issue, it is recommended to deploy a patch.
- CVE-2026-113705Medium
A vulnerability was determined in a2aproject a2a-rs up to 0.4.3. This issue affects some unknown processing of the file a2a-server/src/error.rs. Executing a manipulation can lead to information exposure through error message. The attack can be executed remotely. This patch is called 713b943af94ab2d521d483b841618b97a2e78a4d.
Original NVD description (English source)
A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file crates/server/src/push_notification_sender.rs of the component Push Notification Handler. Such manipulation of the argument TaskPushNotificationConfig leads to server-side request forgery. The attack may be launched remotely. The name of the patch is 2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224. Applying a patch is advised to resolve this issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS