CVE-2026-113706 Details
Description
A vulnerability was identified in a2aproject a2a-rs up to 0.4.3. Impacted is an unknown function of the file a2a-server/src/task_store/inmemory.rs. The manipulation of the argument historyLength leads to information disclosure. The attack is possible to be carried out remotely. The identifier of the patch is 68f1b7e772ae5d6c9e581ac9b48bcddd10fe70eb. To fix this issue, it is recommended to deploy a patch.
An information disclosure vulnerability exists in a2aproject a2a-rs versions through 0.4.3. The issue arises in the a2a-server component, specifically within the task_store/inmemory.rs file. The vulnerability is triggered by manipulating the historyLength argument, allowing for unauthorized information access. This issue can be exploited remotely.
Users are advised to update to a version of a2a-rs that includes the patch for this vulnerability. The latest version can be installed from the official GitHub repository or via Homebrew for macOS users.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 27, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/a2aproject/a2a-rs/ | [email protected] | Vendor |
| https://github.com/a2aproject/a2a-rs/commit/68f1b7e772ae5d6c9e581ac9b48bcddd10fe70eb | [email protected] | Source CodeVendor |
| https://github.com/a2aproject/a2a-rs/pull/122 | [email protected] | Issue TrackingVendor |
| https://vuldb.com/cve/CVE-2026-113706 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1015040 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/422868 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/422868/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor | [email protected] |
| CWE-284 | Improper Access Control | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| a2aproject a2a-rs | <= 0.4.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 27, 2026 | CVE Modified | CISA-ADP |
| Oct 21, 2026 | New CVE Received | [email protected] |