CVE-2026-113705Medium· 5.3▾ SunlitA vulnerability was determined in a2aproject a2a-rs up to 0.4.3. This issue affects some unknown processing of the file a2a-server/src/error.rs. Executing a manipulation can lead to information exposure through error message. The attack …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
A vulnerability was determined in a2aproject a2a-rs up to 0.4.3. This issue affects some unknown processing of the file a2a-server/src/error.rs. Executing a manipulation can lead to information exposure through error message. The attack can be executed remotely. This patch is called 713b943af94ab2d521d483b841618b97a2e78a4d. A patch should be applied to remediate this issue.
a2a-rs 0.4.0a2a-rs 0.4.1a2a-rs 0.4.2a2a-rs 0.4.3Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-113706Low· 3.5a2aproject a2a-rs inmemory.rs information disclosure
CVE-2026-113707Medium· 5.4a2aproject a2a-rs inmemory.rs update race condition
CVE-2026-113704High· 7.3a2aproject a2a-rs Push Notification push_notification_sender.rs HttpPushSender server-side request forgery
CVE-2026-111763Medium· 5.7A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect
CVE-2026-111764High· 7.5A2A Java SDK has a fail-open default task authorization
CVE-2026-111765High· 7.5A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix