---
id: CVE-2026-113706
title: a2aproject a2a-rs inmemory.rs information disclosure
summary: >-
  A vulnerability was identified in a2aproject a2a-rs up to 0.4.3. Impacted is
  an unknown function of the file a2a-server/src/task_store/inmemory.rs. The
  manipulation of the argument historyLength leads to information disclosure.
  The attac…
severity: low
cvss: 3.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C'
cvssSource: cna
cwe:
  - CWE-200
  - CWE-284
vendor: a2aproject
product: a2a-rs
affected:
  - a2a-rs 0.4.0
  - a2a-rs 0.4.1
  - a2a-rs 0.4.2
  - a2a-rs 0.4.3
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T23:15:22.806Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-113706'
references:
  - url: 'https://vuldb.com/vuln/422868'
    label: VDB-422868 | a2aproject a2a-rs inmemory.rs information disclosure
  - url: 'https://vuldb.com/vuln/422868/cti'
    label: 'VDB-422868 | CTI Indicators (IOB, IOC, TTP, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-113706'
    label: CVE-2026-113706 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1015040'
    label: 'Submit #1015040 | a2aproject a2a-rs a2a-server-lf ≤ 0.4.3 CWE-200'
  - url: 'https://github.com/a2aproject/a2a-rs/pull/122'
  - url: >-
      https://github.com/a2aproject/a2a-rs/commit/68f1b7e772ae5d6c9e581ac9b48bcddd10fe70eb
  - url: 'https://github.com/a2aproject/a2a-rs/'
tags:
  - cve.org
ingestedAt: '2026-10-20T23:33:47.222Z'
---

## Overview

A vulnerability was identified in a2aproject a2a-rs up to 0.4.3. Impacted is an unknown function of the file a2a-server/src/task_store/inmemory.rs. The manipulation of the argument historyLength leads to information disclosure. The attack is possible to be carried out remotely. The identifier of the patch is 68f1b7e772ae5d6c9e581ac9b48bcddd10fe70eb. To fix this issue, it is recommended to deploy a patch.

## Affected

- `a2a-rs 0.4.0`
- `a2a-rs 0.4.1`
- `a2a-rs 0.4.2`
- `a2a-rs 0.4.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.