Live › vulnerability › CVE-2026-113705
Go to dashboardUp to version 0.4.3 of the a2a-rs Rust library, the a2a-server error handling in error.rs can expose information through error messages. A remote attacker can trigger the flaw by manipulating requests, and may read internal details from the responses.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running the a2a-server component of a2a-rs at or below 0.4.3 that accept remote requests. Projects that only use the client side or do not expose the server can likely skip it; the sources do not say which exact code paths are reachable by default.
No product ranges from the sources yet.
a2a-rs at 0.4.3 or earliera2a-server from that crate is deployed and reachable from the network713b943af94ab2d521d483b841618b97a2e78a4dEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was determined in a2aproject a2a-rs up to 0.4.3. This issue affects some unknown processing of the file a2a-server/src/error.rs. Executing a manipulation can lead to information exposure through error message. The attack can be executed remotely. This patch is called 713b943af94ab2d521d483b841618b97a2e78a4d. A patch should be applied to remediate this issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-113705")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.