CVE-2026-113705
MediumCVSS 5.3Summary
A vulnerability was determined in a2aproject a2a-rs up to 0.4.3. This issue affects some unknown processing of the file a2a-server/src/error.rs. Executing a manipulation can lead to information exposure through error message. The attack can be executed remotely. This patch is called 713b943af94ab2d521d483b841618b97a2e78a4d.
Risk Assessment
Information exposure through error messages can give an attacker details about the application's internal structure, facilitating further attacks. Organizations using a2a-rs are exposed to remote information gathering.
Recommendation
Apply patch 713b943af94ab2d521d483b841618b97a2e78a4d or upgrade a2a-rs to a version containing this fix. A patch should be applied to remediate the issue.
Other vulnerabilities in a2a-rs
See all- CVE-2026-113707Medium
A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the file a2a-server/src/task_store/inmemory.rs. The manipulation results in race condition. The attack may be performed from remote. The patch is identified as 7050c7d329238539424ee46440e23b91c4825bee.
- CVE-2026-113706Low
A vulnerability was identified in a2aproject a2a-rs up to 0.4.3. Impacted is an unknown function of the file a2a-server/src/task_store/inmemory.rs. The manipulation of the argument historyLength leads to information disclosure. The attack is possible to be carried out remotely. The identifier of the patch is 68f1b7e772ae5d6c9e581ac9b48bcddd10fe70eb. To fix this issue, it is recommended to deploy a patch.
- CVE-2026-113704High
In a2aproject a2a-rs up to 0.4.3, the HttpPushSender function in crates/server/src/push_notification_sender.rs (Push Notification Handler component) allows manipulation of the TaskPushNotificationConfig argument, leading to server-side request forgery. The attack may be launched remotely, and the patch is commit 2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224.
Original NVD description (English source)
A vulnerability was determined in a2aproject a2a-rs up to 0.4.3. This issue affects some unknown processing of the file a2a-server/src/error.rs. Executing a manipulation can lead to information exposure through error message. The attack can be executed remotely. This patch is called 713b943af94ab2d521d483b841618b97a2e78a4d. A patch should be applied to remediate this issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS