CVE-2026-116479
Received Received - Intake

Information Exposure via Error Message in a2a-java

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: VulDB

Description
A flaw has been found in a2aproject a2a-java up to 1.2.0.Final. This impacts the function getMessage of the component JSON-RPC Error Handler. This manipulation causes information exposure through error message. The attack can be initiated remotely. Upgrading to version 1.3.0.Final will fix this issue. Patch name: bbee3369f3825d0fba2373d821f6dc6d4fc82ec0. Upgrading the affected component is advised.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-116479
EUVD
EUVD-2026-110079

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
a2aproject a2a-java 1.2.0.Final

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-209 The product generates an error message that includes sensitive information about its environment, users, or associated data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an information exposure flaw in the a2a-java library up to version 1.2.0.Final. It occurs in the JSON-RPC Error Handler's getMessage function, where raw error messages containing sensitive details like file paths or library names are exposed to remote clients. The issue is fixed in version 1.3.0.Final by sanitizing error messages to show only a generic 'Internal error' message while logging full details server-side.

Detection Guidance

Detect this vulnerability by checking the version of a2a-java in use. If it is below 1.3.0.Final, the system is likely vulnerable. Use commands like 'mvn dependency:tree' in Maven projects or inspect dependency files to verify the version.

Impact Analysis

This vulnerability could allow attackers to gain sensitive information about your system by triggering error conditions. Exposed details might include internal file paths, library versions, or configuration specifics, which could be used to plan further attacks. The impact is limited to information disclosure and does not allow code execution or data modification.

Compliance Impact

This vulnerability could violate compliance requirements under GDPR and HIPAA by exposing sensitive system information through error messages. GDPR requires protecting personal data, and HIPAA mandates safeguarding protected health information. Information leakage through error messages may constitute a breach of these regulations, requiring notification and potential penalties.

Mitigation Strategies

Upgrade the a2a-java component to version 1.3.0.Final or later. This version includes fixes that sanitize error messages to prevent information exposure. Apply the patch bbee3369f3825d0fba2373d821f6dc6d4fc82ec0 if upgrading is not immediately possible.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116479. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart