Live › vulnerability › CVE-2026-113706
Go to dashboardIn a2a-rs up to 0.4.3, the historyLength argument handled by the in-memory task store can be manipulated to disclose information. The sources describe the impact only as information disclosure reachable remotely.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams running the a2a-rs server crate with the in-memory task store that accepts requests carrying a historyLength argument are potentially exposed. The sources do not say which deployments or configurations are required, so the exact exposure is unknown. Teams not using a2a-rs can skip it.
No product ranges from the sources yet.
a2a-rs at or below 0.4.30.4.3 to a release that includes patch 68f1b7e772ae5d6c9e581ac9b48bcddd10fe70ebEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability was identified in a2aproject a2a-rs up to 0.4.3. Impacted is an unknown function of the file a2a-server/src/task_store/inmemory.rs. The manipulation of the argument historyLength leads to information disclosure. The attack is possible to be carried out remotely. The identifier of the patch is 68f1b7e772ae5d6c9e581ac9b48bcddd10fe70eb. To fix this issue, it is recommended to deploy a patch.
This page as .md · .json · in your agent: get_signal("CVE-2026-113706")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.