CVE-2026-113706

Deferred Deferred - Pending Action

Information Disclosure in a2a-rs via historyLength Parameter

Publication date: 2026-10-21

Last updated on: 2026-10-27

Assigner: VulDB

Description

A vulnerability was identified in a2aproject a2a-rs up to 0.4.3. Impacted is an unknown function of the file a2a-server/src/task_store/inmemory.rs. The manipulation of the argument historyLength leads to information disclosure. The attack is possible to be carried out remotely. The identifier of the patch is 68f1b7e772ae5d6c9e581ac9b48bcddd10fe70eb. To fix this issue, it is recommended to deploy a patch.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-27

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-113706

EUVD

EUVD-2026-106877

Affected Vendors & Products

Vendor	Product	Version / Range
a2aproject	a2a-rs	0.4.0
a2aproject	a2a-rs	0.4.1
a2aproject	a2a-rs	0.4.2
a2aproject	a2a-rs	0.4.3

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-200	The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability affects the a2a-rs Rust SDK up to version 0.4.3. It involves improper handling of the historyLength argument in the a2a-server component. When manipulated, this flaw allows attackers to remotely access sensitive information by disclosing conversation history.

Detection Guidance

To detect this vulnerability, check if your a2a-rs server version is up to 0.4.3. Inspect the task listing endpoints for improper handling of the historyLength parameter. Look for cases where negative values wrap to usize::MAX, exposing full conversation history. Monitor for INVALID_PARAMS errors when invalid status filters or pageToken values are provided.

Impact Analysis

An attacker could exploit this to view private conversation history or task data stored by the server. This may lead to unauthorized access to sensitive information if the server processes tasks containing confidential data.

Compliance Impact

This vulnerability could violate data protection requirements under GDPR and HIPAA by enabling unauthorized disclosure of personal or health information. Organizations using affected versions may face compliance violations and legal consequences.

Mitigation Strategies

Update the a2a-rs server to the patched version that includes input validation for historyLength and other parameters. Apply the patch from commit 68f1b7e772ae5d6c9e581ac9b48bcddd10fe70eb to fix the information disclosure issue.

Hi! I’m here to help you understand CVE-2026-113706. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...