CVE-2026-113706mediumCWE-200CWE-284

CVE-2026-113706: medium-severity vulnerability in a2aproject a2a-rs

a2aproject a2a-rs inmemory.rs information disclosure

Published · Updated

Follow this CVE+ Monitor a2a-rs

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.1epss 0.3%
A vulnerability was identified in a2aproject a2a-rs up to 0.4.3. Impacted is an unknown function of the file a2a-server/src/task_store/inmemory.rs. The manipulation of the argument historyLength leads to information disclosure. The attack is possible to be carried out remotely. The identifier of the patch is 68f1b7e772ae5d6c9e581ac9b48bcddd10fe70eb. To fix this issue, it is recommended to deploy a patch.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X
Affected products
a2aproject · a2a-rs
Related CVEs — a2aproject a2a-rs

In the same product, most dangerous first.

CVE-2026-113704MEDIUMa2aproject a2a-rs Push Notification push_notification_sender.rs HttpPushSender server-side request forgeryEPSS 0.5%CVE-2026-113705MEDIUMa2aproject a2a-rs error.rs information exposureEPSS 0.3%CVE-2026-113707MEDIUMa2aproject a2a-rs inmemory.rs update race conditionEPSS 0.3%