Low severity · published Oct 20, 2026
CVE-2026-113706
a2aproject a2a-rs inmemory.rs information disclosure
3.5
CVSS
0.2%
EPSS
No
On KEV
Description
A vulnerability was identified in a2aproject a2a-rs up to 0.4.3. Impacted is an unknown function of the file a2a-server/src/task_store/inmemory.rs. The manipulation of the argument historyLength leads to information disclosure. The attack is possible to be carried out remotely. The identifier of the patch is 68f1b7e772ae5d6c9e581ac9b48bcddd10fe70eb. To fix this issue, it is recommended to deploy a patch.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
A2
a2a-rs · a2aproject
0.4.0; 0.4.1; 0.4.2; 0.4.3 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-113706
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-113706
github.com
https://github.com/a2aproject/a2a-rs/
github.com
https://github.com/a2aproject/a2a-rs/commit/68f1b7e772ae5d6c9e581ac9b48bcddd10fe70eb
github.com
https://github.com/a2aproject/a2a-rs/pull/122
vuldb.com
https://vuldb.com/cve/CVE-2026-113706
vuldb.com
https://vuldb.com/submit/1015040
vuldb.com
https://vuldb.com/vuln/422868
More from a2a-rs
7.3
CVE-2026-113704
a2aproject a2a-rs Push Notification push_notification_sender.rs HttpPushSender server-side request forgery
5.4
CVE-2026-113707
a2aproject a2a-rs inmemory.rs update race condition
5.3
CVE-2026-113705
a2aproject a2a-rs error.rs information exposure