CVE-2026-113706
LowCVSS 3.5Summary
A vulnerability was identified in a2aproject a2a-rs up to 0.4.3. Impacted is an unknown function of the file a2a-server/src/task_store/inmemory.rs. The manipulation of the argument historyLength leads to information disclosure. The attack is possible to be carried out remotely. The identifier of the patch is 68f1b7e772ae5d6c9e581ac9b48bcddd10fe70eb. To fix this issue, it is recommended to deploy a patch.
Risk Assessment
Information disclosure may allow an attacker to access data that should not be visible, potentially compromising the confidentiality of the system.
Recommendation
Deploy the patch with identifier 68f1b7e772ae5d6c9e581ac9b48bcddd10fe70eb or update a2a-rs to a version containing this fix.
Other vulnerabilities in a2a-rs
See all- CVE-2026-113707Medium
A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the file a2a-server/src/task_store/inmemory.rs. The manipulation results in race condition. The attack may be performed from remote. The patch is identified as 7050c7d329238539424ee46440e23b91c4825bee.
- CVE-2026-113705Medium
A vulnerability was determined in a2aproject a2a-rs up to 0.4.3. This issue affects some unknown processing of the file a2a-server/src/error.rs. Executing a manipulation can lead to information exposure through error message. The attack can be executed remotely. This patch is called 713b943af94ab2d521d483b841618b97a2e78a4d.
- CVE-2026-113704High
In a2aproject a2a-rs up to 0.4.3, the HttpPushSender function in crates/server/src/push_notification_sender.rs (Push Notification Handler component) allows manipulation of the TaskPushNotificationConfig argument, leading to server-side request forgery. The attack may be launched remotely, and the patch is commit 2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224.
Original NVD description (English source)
A vulnerability was identified in a2aproject a2a-rs up to 0.4.3. Impacted is an unknown function of the file a2a-server/src/task_store/inmemory.rs. The manipulation of the argument historyLength leads to information disclosure. The attack is possible to be carried out remotely. The identifier of the patch is 68f1b7e772ae5d6c9e581ac9b48bcddd10fe70eb. To fix this issue, it is recommended to deploy a patch.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS