Live › vulnerability › CVE-2026-116479
Go to dashboardThe getMessage function in the JSON-RPC Error Handler of a2a-java up to 1.2.0.Final exposes information through error messages. A remote attacker can trigger the error path and read the leaked details.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 20:50 UTC. All times on this page are UTC.
Applications that embed a2a-java up to 1.2.0.Final and expose its JSON-RPC endpoint to remote callers are exposed. Services that do not use a2a-java, or that are on 1.3.0.Final or later, can skip it. The sources do not say which request types trigger the leak.
No product ranges from the sources yet.
io.github.a2aproject:a2a-java or equivalent) and confirm whether it is 1.2.0.Final or earlier.1.3.0.Final or later, per the upstream patch bbee3369f3825d0fba2373d821f6dc6d4fc82ec0.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A flaw has been found in a2aproject a2a-java up to 1.2.0.Final. This impacts the function getMessage of the component JSON-RPC Error Handler. This manipulation causes information exposure through error message. The attack can be initiated remotely. Upgrading to version 1.3.0.Final will fix this issue. Patch name: bbee3369f3825d0fba2373d821f6dc6d4fc82ec0. Upgrading the affected component is advised.
This page as .md · .json · in your agent: get_signal("CVE-2026-116479")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.