{"id":"CVE-2026-113706","kind":"vulnerability","aliases":["CVE-2026-113706"],"related":[],"title":"a2a-rs: historyLength argument leaks information in in-memory task store","description":"A vulnerability was identified in a2aproject a2a-rs up to 0.4.3. Impacted is an unknown function of the file a2a-server/src/task_store/inmemory.rs. The manipulation of the argument historyLength leads to information disclosure. The attack is possible to be carried out remotely. The identifier of the patch is 68f1b7e772ae5d6c9e581ac9b48bcddd10fe70eb. To fix this issue, it is recommended to deploy a patch.","summary":"In a2a-rs up to 0.4.3, the historyLength argument handled by the in-memory task store can be manipulated to disclose information. The sources describe the impact only as information disclosure reachable remotely.","severity":"medium","cvss":5.1,"epss":0.0025,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["a2a","package","rust","self-hosted"],"not_affected_if":["not-using-a2a-rs"],"how_to_check":"- Check the a2a-rs version in Cargo.lock or Cargo.toml for `a2a-rs` at or below `0.4.3`\n- Check whether the a2a-server crate uses the in-memory task store (a2a-server/src/task_store/inmemory.rs)","fix":"- Upgrade a2a-rs past `0.4.3` to a release that includes patch `68f1b7e772ae5d6c9e581ac9b48bcddd10fe70eb`\n- unknown: the sources do not name a fixed release version","status":"open","published_at":"2026-10-21T00:17:48+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","triaged_at":"2026-10-25T04:29:02+00:00","updated_at":"2026-10-25T04:29:02+00:00","category":"package","confidence":0.4,"triage":{"at":"2026-10-25T04:29:02Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade a2a-rs past `0.4.3` to a release that includes patch `68f1b7e772ae5d6c9e581ac9b48bcddd10fe70eb`\n- unknown: the sources do not name a fixed release version","reach":"internet","title":"a2a-rs: historyLength argument leaks information in in-memory task store","impact":"low","summary":"In a2a-rs up to 0.4.3, the historyLength argument handled by the in-memory task store can be manipulated to disclose information. The sources describe the impact only as information disclosure reachable remotely.","category":"package","nicknames":[],"who_cares":["rust","a2a","self-hosted"],"confidence":0.4,"needs_auth":"unknown","worst_case":"remote attacker reads information from task history data","analyst_note":"Confirm the fixed release version and which deployments reach the in-memory task store, using the NVD entry and the linked patch commit.","how_to_check":"- Check the a2a-rs version in Cargo.lock or Cargo.toml for `a2a-rs` at or below `0.4.3`\n- Check whether the a2a-server crate uses the in-memory task store (a2a-server/src/task_store/inmemory.rs)","needs_analyst":true,"not_affected_if":["not-using-a2a-rs"],"who_is_affected":"Teams running the a2a-rs server crate with the in-memory task store that accepts requests carrying a historyLength argument are potentially exposed. The sources do not say which deployments or configurations are required, so the exact exposure is unknown. Teams not using a2a-rs can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000636,"input_tokens":3411,"output_tokens":589,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-113706':16A,19A '-2026':15A,18A '/src/task_store/inmemory.rs':84C '0.4.3':32B,72C '68f1b7e772ae5d6c9e581ac9b48bcddd10fe70eb':110C 'a2a':2A,20B,28B,68C,82C 'a2a-rs':1A,27B,67C 'a2a-server':81C 'a2aproject':66C 'argument':5A,35B,89C 'attack':96C 'carri':101C 'cve':14A,17A 'deploy':119C 'describ':52B 'disclos':48B 'disclosur':58B,94C 'file':80C 'fix':112C 'function':77C 'handl':36B 'historylength':4A,34B,90C 'host':25B 'identifi':64C,105C 'impact':54B,73C 'in-memori':9A,39B 'inform':7A,49B,57B,93C 'issu':114C 'lead':91C 'leak':6A 'manipul':46B,86C 'memori':11A,41B 'packag':21B 'patch':108C,121C 'possibl':98C 'reachabl':59B 'recommend':117C 'remot':60B,103C 'rs':3A,29B,69C 'rust':22B 'self':24B 'self-host':23B 'server':83C 'sourc':51B 'store':13A,43B 'task':12A,42B 'unknown':76C 'vulner':62C","nicknames":[],"mitigations":[],"who_affected":"Teams running the a2a-rs server crate with the in-memory task store that accepts requests carrying a historyLength argument are potentially exposed. The sources do not say which deployments or configurations are required, so the exact exposure is unknown. Teams not using a2a-rs can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T00:17:48+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-113706","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-113706","severity":null,"published_at":"2026-10-21T00:17:48+00:00","modified_at":"2026-10-21T14:26:26+00:00","first_seen_at":"2026-10-23T21:57:27+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-113706","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-113706","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}