CVE-2026-113706 a2aproject CVE debrief

Who should care

Defenders of systems using a2aproject a2a-rs up to 0.4.3 should assess exposure and prioritize patching to prevent potential information disclosure. This includes reviewing system configurations, version histories, and potential attack vectors to understand the full extent of the vulnerability. Defenders should also verify the scope of affected versions and monitor for potential information disclosure. Security teams and vulnerability management teams are

Why it matters

Defenders of systems using a2aproject a2a-rs up to 0.4.3 should assess exposure and prioritize patching to prevent potential information disclosure.

• Potential information disclosure
• Need to verify scope of affected versions
• Need to verify potential impact
• Priority for patching vulnerable function

Technical summary

The vulnerability is in the a2a-server/src/task_store/inmemory.rs file, and the manipulation of the argument historyLength leads to information disclosure. This occurs because the function does not properly handle the historyLength argument, allowing an attacker to potentially access sensitive information. The vulnerability is remotely exploitable and affects a2aproject a2a-rs up to version 0.4.3. Defenders should prioritize patching the vulnerable function to prevent potential information disclosure. Additionally, defenders should review system configurations and version histories to understand the full extent of the vulnerability.

Defensive priority

Defenders should prioritize patching the vulnerable function in a2a-rs up to 0.4.3.

Recommended defensive actions

• Patch the vulnerable function in a2a-rs up to 0.4.3
• Verify the scope of affected versions
• Monitor for potential information disclosure
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but the scope of affected versions and potential impact require further verification by defenders. Additional review of system configurations, version histories, and potential attack vectors is necessary to understand the full extent of the vulnerability. Specifically, defenders should verify the historyLength argument manipulation and its implications on information disclosure. This may involve reviewing system logs, monitoring for suspicious activity, and assessing 3

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.