Low 5.1

a2aproject a2a-rs inmemory.rs information disclosure

CVE-2026-113706 First seen on SecPulse Oct 21, 09:17

Affected packages

Ecosystem	Package	Affected	Fixed
a2aproject	a2a-rs	—	—

Original description The description as published by the source.

A vulnerability was identified in a2aproject a2a-rs up to 0.4.3. Impacted is an unknown function of the file a2a-server/src/task_store/inmemory.rs. The manipulation of the argument historyLength leads to information disclosure. The attack is possible to be carried out remotely. The identifier of the patch is 68f1b7e772ae5d6c9e581ac9b48bcddd10fe70eb. To fix this issue, it is recommended to deploy a patch.

Source: NIST National Vulnerability Database NVD GitHub Advisory

References

Key facts

CVSS v3: Low 3.5; CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N
CVSS v4: Medium 5.1; CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Published: Oct 21, 2026
First seen on SecPulse: Oct 21, 09:17
GHSA: GHSA-j4c2-997p-844j
CWE: CWE-200 CWE-284

NVD GitHub Advisory

Tags(click for explanation)

CWE

CWE-200 CWE-284

All

A2Aproject A2A Rs

Detection sources

OSV.dev (Open Source Vulnerabilities)Oct 24, 11:48
NIST National Vulnerability DatabaseOct 28, 07:17
GitHub Security Advisories (Global)Oct 21, 09:34
CVE.org (CVE Program・cvelistV5)Oct 28, 06:32