Search
Find a vulnerability
Search criteria
8 vulnerabilities found for a2a-rs by a2aproject
CVE-2026-113707 (GCVE-0-2026-113707)
Vulnerability from nvd – Published: 2026-10-20 23:30 – Updated: 2026-10-20 23:30 X_Open Source
VLAI
EPSS
VEX
Title
a2aproject a2a-rs inmemory.rs update race condition
Summary
A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the file a2a-server/src/task_store/inmemory.rs. The manipulation results in race condition. The attack may be performed from remote. The patch is identified as 7050c7d329238539424ee46440e23b91c4825bee. It is advisable to implement a patch to correct this issue.
Severity
CWE
- CWE-362 - Race Condition
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/422869 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/422869/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-113707 | third-party-advisory |
| https://vuldb.com/submit/1015056 | third-party-advisory |
| https://github.com/a2aproject/a2a-rs/pull/126 | issue-trackingpatch |
| https://github.com/a2aproject/a2a-rs/commit/7050c… | patch |
| https://github.com/a2aproject/a2a-rs/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| a2aproject | a2a-rs |
Affected:
0.4.0
Affected: 0.4.1 Affected: 0.4.2 Affected: 0.4.3 Affected: 0.4.4 cpe:2.3:a:a2aproject:a2a-rs:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:a2aproject:a2a-rs:*:*:*:*:*:*:*:*"
],
"product": "a2a-rs",
"vendor": "a2aproject",
"versions": [
{
"status": "affected",
"version": "0.4.0"
},
{
"status": "affected",
"version": "0.4.1"
},
{
"status": "affected",
"version": "0.4.2"
},
{
"status": "affected",
"version": "0.4.3"
},
{
"status": "affected",
"version": "0.4.4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "colorfullbz (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the file a2a-server/src/task_store/inmemory.rs. The manipulation results in race condition. The attack may be performed from remote. The patch is identified as 7050c7d329238539424ee46440e23b91c4825bee. It is advisable to implement a patch to correct this issue."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.5,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "Race Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T23:30:22.622Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-422869 | a2aproject a2a-rs inmemory.rs update race condition",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/422869"
},
{
"name": "VDB-422869 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/422869/cti"
},
{
"name": "CVE-2026-113707 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-113707"
},
{
"name": "Submit #1015056 | a2aproject a2a-rs a2a-server-lf \u2264 0.4.4 CWE-362",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1015056"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/a2aproject/a2a-rs/pull/126"
},
{
"tags": [
"patch"
],
"url": "https://github.com/a2aproject/a2a-rs/commit/7050c7d329238539424ee46440e23b91c4825bee"
},
{
"tags": [
"product"
],
"url": "https://github.com/a2aproject/a2a-rs/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-20T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-20T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-20T18:02:52.000Z",
"value": "VulDB entry last update"
}
],
"title": "a2aproject a2a-rs inmemory.rs update race condition",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-113707",
"datePublished": "2026-10-20T23:30:22.622Z",
"dateReserved": "2026-10-20T15:57:23.915Z",
"dateUpdated": "2026-10-20T23:30:22.622Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113706 (GCVE-0-2026-113706)
Vulnerability from nvd – Published: 2026-10-20 23:15 – Updated: 2026-10-20 23:15 X_Open Source
VLAI
EPSS
VEX
Title
a2aproject a2a-rs inmemory.rs information disclosure
Summary
A vulnerability was identified in a2aproject a2a-rs up to 0.4.3. Impacted is an unknown function of the file a2a-server/src/task_store/inmemory.rs. The manipulation of the argument historyLength leads to information disclosure. The attack is possible to be carried out remotely. The identifier of the patch is 68f1b7e772ae5d6c9e581ac9b48bcddd10fe70eb. To fix this issue, it is recommended to deploy a patch.
Severity
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/422868 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/422868/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-113706 | third-party-advisory |
| https://vuldb.com/submit/1015040 | third-party-advisory |
| https://github.com/a2aproject/a2a-rs/pull/122 | issue-trackingpatch |
| https://github.com/a2aproject/a2a-rs/commit/68f1b… | patch |
| https://github.com/a2aproject/a2a-rs/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| a2aproject | a2a-rs |
Affected:
0.4.0
Affected: 0.4.1 Affected: 0.4.2 Affected: 0.4.3 cpe:2.3:a:a2aproject:a2a-rs:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:a2aproject:a2a-rs:*:*:*:*:*:*:*:*"
],
"product": "a2a-rs",
"vendor": "a2aproject",
"versions": [
{
"status": "affected",
"version": "0.4.0"
},
{
"status": "affected",
"version": "0.4.1"
},
{
"status": "affected",
"version": "0.4.2"
},
{
"status": "affected",
"version": "0.4.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "colorfullbz (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in a2aproject a2a-rs up to 0.4.3. Impacted is an unknown function of the file a2a-server/src/task_store/inmemory.rs. The manipulation of the argument historyLength leads to information disclosure. The attack is possible to be carried out remotely. The identifier of the patch is 68f1b7e772ae5d6c9e581ac9b48bcddd10fe70eb. To fix this issue, it is recommended to deploy a patch."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Information Disclosure",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T23:15:22.806Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-422868 | a2aproject a2a-rs inmemory.rs information disclosure",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/422868"
},
{
"name": "VDB-422868 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/422868/cti"
},
{
"name": "CVE-2026-113706 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-113706"
},
{
"name": "Submit #1015040 | a2aproject a2a-rs a2a-server-lf \u2264 0.4.3 CWE-200",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1015040"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/a2aproject/a2a-rs/pull/122"
},
{
"tags": [
"patch"
],
"url": "https://github.com/a2aproject/a2a-rs/commit/68f1b7e772ae5d6c9e581ac9b48bcddd10fe70eb"
},
{
"tags": [
"product"
],
"url": "https://github.com/a2aproject/a2a-rs/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-20T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-20T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-20T18:02:48.000Z",
"value": "VulDB entry last update"
}
],
"title": "a2aproject a2a-rs inmemory.rs information disclosure",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-113706",
"datePublished": "2026-10-20T23:15:22.806Z",
"dateReserved": "2026-10-20T15:57:19.225Z",
"dateUpdated": "2026-10-20T23:15:22.806Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113705 (GCVE-0-2026-113705)
Vulnerability from nvd – Published: 2026-10-20 22:45 – Updated: 2026-10-20 22:45 X_Open Source
VLAI
EPSS
VEX
Title
a2aproject a2a-rs error.rs information exposure
Summary
A vulnerability was determined in a2aproject a2a-rs up to 0.4.3. This issue affects some unknown processing of the file a2a-server/src/error.rs. Executing a manipulation can lead to information exposure through error message. The attack can be executed remotely. This patch is called 713b943af94ab2d521d483b841618b97a2e78a4d. A patch should be applied to remediate this issue.
Severity
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/422867 | vdb-entry |
| https://vuldb.com/vuln/422867/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-113705 | third-party-advisory |
| https://vuldb.com/submit/1014888 | third-party-advisory |
| https://github.com/a2aproject/a2a-rs/pull/127 | issue-trackingpatch |
| https://github.com/a2aproject/a2a-rs/commit/713b9… | patch |
| https://github.com/a2aproject/a2a-rs/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| a2aproject | a2a-rs |
Affected:
0.4.0
Affected: 0.4.1 Affected: 0.4.2 Affected: 0.4.3 cpe:2.3:a:a2aproject:a2a-rs:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:a2aproject:a2a-rs:*:*:*:*:*:*:*:*"
],
"product": "a2a-rs",
"vendor": "a2aproject",
"versions": [
{
"status": "affected",
"version": "0.4.0"
},
{
"status": "affected",
"version": "0.4.1"
},
{
"status": "affected",
"version": "0.4.2"
},
{
"status": "affected",
"version": "0.4.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "colorfullbz (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in a2aproject a2a-rs up to 0.4.3. This issue affects some unknown processing of the file a2a-server/src/error.rs. Executing a manipulation can lead to information exposure through error message. The attack can be executed remotely. This patch is called 713b943af94ab2d521d483b841618b97a2e78a4d. A patch should be applied to remediate this issue."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "Information Exposure Through Error Message",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Information Disclosure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T22:45:09.343Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-422867 | a2aproject a2a-rs error.rs information exposure",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/422867"
},
{
"name": "VDB-422867 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/422867/cti"
},
{
"name": "CVE-2026-113705 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-113705"
},
{
"name": "Submit #1014888 | a2aproject a2a-rs a2a-server-lf \u2264 0.4.3 CWE-209",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1014888"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/a2aproject/a2a-rs/pull/127"
},
{
"tags": [
"patch"
],
"url": "https://github.com/a2aproject/a2a-rs/commit/713b943af94ab2d521d483b841618b97a2e78a4d"
},
{
"tags": [
"product"
],
"url": "https://github.com/a2aproject/a2a-rs/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-20T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-20T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-20T18:02:44.000Z",
"value": "VulDB entry last update"
}
],
"title": "a2aproject a2a-rs error.rs information exposure",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-113705",
"datePublished": "2026-10-20T22:45:09.343Z",
"dateReserved": "2026-10-20T15:57:15.561Z",
"dateUpdated": "2026-10-20T22:45:09.343Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113704 (GCVE-0-2026-113704)
Vulnerability from nvd – Published: 2026-10-20 22:00 – Updated: 2026-10-21 15:51 X_Open Source
VLAI
EPSS
VEX
Title
a2aproject a2a-rs Push Notification push_notification_sender.rs HttpPushSender server-side request forgery
Summary
A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file crates/server/src/push_notification_sender.rs of the component Push Notification Handler. Such manipulation of the argument TaskPushNotificationConfig leads to server-side request forgery. The attack may be launched remotely. The name of the patch is 2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224. Applying a patch is advised to resolve this issue.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-21 14:40 UTC
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/422865 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/422865/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-113704 | third-party-advisory |
| https://vuldb.com/submit/1014883 | third-party-advisory |
| https://github.com/a2aproject/a2a-rs/pull/124 | issue-trackingpatch |
| https://github.com/a2aproject/a2a-rs/commit/2ba50… | patch |
| https://github.com/a2aproject/a2a-rs/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| a2aproject | a2a-rs |
Affected:
0.4.0
Affected: 0.4.1 Affected: 0.4.2 Affected: 0.4.3 cpe:2.3:a:a2aproject:a2a-rs:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-113704",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T14:40:30.871594Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T15:51:31.062Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:a2aproject:a2a-rs:*:*:*:*:*:*:*:*"
],
"modules": [
"Push Notification Handler"
],
"product": "a2a-rs",
"vendor": "a2aproject",
"versions": [
{
"status": "affected",
"version": "0.4.0"
},
{
"status": "affected",
"version": "0.4.1"
},
{
"status": "affected",
"version": "0.4.2"
},
{
"status": "affected",
"version": "0.4.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "colorfullbz (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file crates/server/src/push_notification_sender.rs of the component Push Notification Handler. Such manipulation of the argument TaskPushNotificationConfig leads to server-side request forgery. The attack may be launched remotely. The name of the patch is 2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224. Applying a patch is advised to resolve this issue."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T22:00:25.887Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-422865 | a2aproject a2a-rs Push Notification push_notification_sender.rs HttpPushSender server-side request forgery",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/422865"
},
{
"name": "VDB-422865 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/422865/cti"
},
{
"name": "CVE-2026-113704 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-113704"
},
{
"name": "Submit #1014883 | a2aproject a2a-rs a2a-server-lf \u2264 0.4.3 SSRF",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1014883"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/a2aproject/a2a-rs/pull/124"
},
{
"tags": [
"patch"
],
"url": "https://github.com/a2aproject/a2a-rs/commit/2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224"
},
{
"tags": [
"product"
],
"url": "https://github.com/a2aproject/a2a-rs/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-20T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-20T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-20T18:02:40.000Z",
"value": "VulDB entry last update"
}
],
"title": "a2aproject a2a-rs Push Notification push_notification_sender.rs HttpPushSender server-side request forgery",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-113704",
"datePublished": "2026-10-20T22:00:25.887Z",
"dateReserved": "2026-10-20T15:57:11.575Z",
"dateUpdated": "2026-10-21T15:51:31.062Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113707 (GCVE-0-2026-113707)
Vulnerability from cvelistv5 – Published: 2026-10-20 23:30 – Updated: 2026-10-20 23:30 X_Open Source
VLAI
EPSS
VEX
Title
a2aproject a2a-rs inmemory.rs update race condition
Summary
A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the file a2a-server/src/task_store/inmemory.rs. The manipulation results in race condition. The attack may be performed from remote. The patch is identified as 7050c7d329238539424ee46440e23b91c4825bee. It is advisable to implement a patch to correct this issue.
Severity
CWE
- CWE-362 - Race Condition
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/422869 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/422869/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-113707 | third-party-advisory |
| https://vuldb.com/submit/1015056 | third-party-advisory |
| https://github.com/a2aproject/a2a-rs/pull/126 | issue-trackingpatch |
| https://github.com/a2aproject/a2a-rs/commit/7050c… | patch |
| https://github.com/a2aproject/a2a-rs/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| a2aproject | a2a-rs |
Affected:
0.4.0
Affected: 0.4.1 Affected: 0.4.2 Affected: 0.4.3 Affected: 0.4.4 cpe:2.3:a:a2aproject:a2a-rs:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:a2aproject:a2a-rs:*:*:*:*:*:*:*:*"
],
"product": "a2a-rs",
"vendor": "a2aproject",
"versions": [
{
"status": "affected",
"version": "0.4.0"
},
{
"status": "affected",
"version": "0.4.1"
},
{
"status": "affected",
"version": "0.4.2"
},
{
"status": "affected",
"version": "0.4.3"
},
{
"status": "affected",
"version": "0.4.4"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "colorfullbz (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the file a2a-server/src/task_store/inmemory.rs. The manipulation results in race condition. The attack may be performed from remote. The patch is identified as 7050c7d329238539424ee46440e23b91c4825bee. It is advisable to implement a patch to correct this issue."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5.5,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "Race Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T23:30:22.622Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-422869 | a2aproject a2a-rs inmemory.rs update race condition",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/422869"
},
{
"name": "VDB-422869 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/422869/cti"
},
{
"name": "CVE-2026-113707 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-113707"
},
{
"name": "Submit #1015056 | a2aproject a2a-rs a2a-server-lf \u2264 0.4.4 CWE-362",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1015056"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/a2aproject/a2a-rs/pull/126"
},
{
"tags": [
"patch"
],
"url": "https://github.com/a2aproject/a2a-rs/commit/7050c7d329238539424ee46440e23b91c4825bee"
},
{
"tags": [
"product"
],
"url": "https://github.com/a2aproject/a2a-rs/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-20T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-20T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-20T18:02:52.000Z",
"value": "VulDB entry last update"
}
],
"title": "a2aproject a2a-rs inmemory.rs update race condition",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-113707",
"datePublished": "2026-10-20T23:30:22.622Z",
"dateReserved": "2026-10-20T15:57:23.915Z",
"dateUpdated": "2026-10-20T23:30:22.622Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113706 (GCVE-0-2026-113706)
Vulnerability from cvelistv5 – Published: 2026-10-20 23:15 – Updated: 2026-10-20 23:15 X_Open Source
VLAI
EPSS
VEX
Title
a2aproject a2a-rs inmemory.rs information disclosure
Summary
A vulnerability was identified in a2aproject a2a-rs up to 0.4.3. Impacted is an unknown function of the file a2a-server/src/task_store/inmemory.rs. The manipulation of the argument historyLength leads to information disclosure. The attack is possible to be carried out remotely. The identifier of the patch is 68f1b7e772ae5d6c9e581ac9b48bcddd10fe70eb. To fix this issue, it is recommended to deploy a patch.
Severity
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/422868 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/422868/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-113706 | third-party-advisory |
| https://vuldb.com/submit/1015040 | third-party-advisory |
| https://github.com/a2aproject/a2a-rs/pull/122 | issue-trackingpatch |
| https://github.com/a2aproject/a2a-rs/commit/68f1b… | patch |
| https://github.com/a2aproject/a2a-rs/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| a2aproject | a2a-rs |
Affected:
0.4.0
Affected: 0.4.1 Affected: 0.4.2 Affected: 0.4.3 cpe:2.3:a:a2aproject:a2a-rs:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:a2aproject:a2a-rs:*:*:*:*:*:*:*:*"
],
"product": "a2a-rs",
"vendor": "a2aproject",
"versions": [
{
"status": "affected",
"version": "0.4.0"
},
{
"status": "affected",
"version": "0.4.1"
},
{
"status": "affected",
"version": "0.4.2"
},
{
"status": "affected",
"version": "0.4.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "colorfullbz (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in a2aproject a2a-rs up to 0.4.3. Impacted is an unknown function of the file a2a-server/src/task_store/inmemory.rs. The manipulation of the argument historyLength leads to information disclosure. The attack is possible to be carried out remotely. The identifier of the patch is 68f1b7e772ae5d6c9e581ac9b48bcddd10fe70eb. To fix this issue, it is recommended to deploy a patch."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.5,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Information Disclosure",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-284",
"description": "Improper Access Controls",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T23:15:22.806Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-422868 | a2aproject a2a-rs inmemory.rs information disclosure",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/422868"
},
{
"name": "VDB-422868 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/422868/cti"
},
{
"name": "CVE-2026-113706 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-113706"
},
{
"name": "Submit #1015040 | a2aproject a2a-rs a2a-server-lf \u2264 0.4.3 CWE-200",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1015040"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/a2aproject/a2a-rs/pull/122"
},
{
"tags": [
"patch"
],
"url": "https://github.com/a2aproject/a2a-rs/commit/68f1b7e772ae5d6c9e581ac9b48bcddd10fe70eb"
},
{
"tags": [
"product"
],
"url": "https://github.com/a2aproject/a2a-rs/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-20T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-20T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-20T18:02:48.000Z",
"value": "VulDB entry last update"
}
],
"title": "a2aproject a2a-rs inmemory.rs information disclosure",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-113706",
"datePublished": "2026-10-20T23:15:22.806Z",
"dateReserved": "2026-10-20T15:57:19.225Z",
"dateUpdated": "2026-10-20T23:15:22.806Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113705 (GCVE-0-2026-113705)
Vulnerability from cvelistv5 – Published: 2026-10-20 22:45 – Updated: 2026-10-20 22:45 X_Open Source
VLAI
EPSS
VEX
Title
a2aproject a2a-rs error.rs information exposure
Summary
A vulnerability was determined in a2aproject a2a-rs up to 0.4.3. This issue affects some unknown processing of the file a2a-server/src/error.rs. Executing a manipulation can lead to information exposure through error message. The attack can be executed remotely. This patch is called 713b943af94ab2d521d483b841618b97a2e78a4d. A patch should be applied to remediate this issue.
Severity
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/422867 | vdb-entry |
| https://vuldb.com/vuln/422867/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-113705 | third-party-advisory |
| https://vuldb.com/submit/1014888 | third-party-advisory |
| https://github.com/a2aproject/a2a-rs/pull/127 | issue-trackingpatch |
| https://github.com/a2aproject/a2a-rs/commit/713b9… | patch |
| https://github.com/a2aproject/a2a-rs/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| a2aproject | a2a-rs |
Affected:
0.4.0
Affected: 0.4.1 Affected: 0.4.2 Affected: 0.4.3 cpe:2.3:a:a2aproject:a2a-rs:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:a2aproject:a2a-rs:*:*:*:*:*:*:*:*"
],
"product": "a2a-rs",
"vendor": "a2aproject",
"versions": [
{
"status": "affected",
"version": "0.4.0"
},
{
"status": "affected",
"version": "0.4.1"
},
{
"status": "affected",
"version": "0.4.2"
},
{
"status": "affected",
"version": "0.4.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "colorfullbz (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in a2aproject a2a-rs up to 0.4.3. This issue affects some unknown processing of the file a2a-server/src/error.rs. Executing a manipulation can lead to information exposure through error message. The attack can be executed remotely. This patch is called 713b943af94ab2d521d483b841618b97a2e78a4d. A patch should be applied to remediate this issue."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-209",
"description": "Information Exposure Through Error Message",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-200",
"description": "Information Disclosure",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T22:45:09.343Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-422867 | a2aproject a2a-rs error.rs information exposure",
"tags": [
"vdb-entry"
],
"url": "https://vuldb.com/vuln/422867"
},
{
"name": "VDB-422867 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/422867/cti"
},
{
"name": "CVE-2026-113705 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-113705"
},
{
"name": "Submit #1014888 | a2aproject a2a-rs a2a-server-lf \u2264 0.4.3 CWE-209",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1014888"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/a2aproject/a2a-rs/pull/127"
},
{
"tags": [
"patch"
],
"url": "https://github.com/a2aproject/a2a-rs/commit/713b943af94ab2d521d483b841618b97a2e78a4d"
},
{
"tags": [
"product"
],
"url": "https://github.com/a2aproject/a2a-rs/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-20T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-20T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-20T18:02:44.000Z",
"value": "VulDB entry last update"
}
],
"title": "a2aproject a2a-rs error.rs information exposure",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-113705",
"datePublished": "2026-10-20T22:45:09.343Z",
"dateReserved": "2026-10-20T15:57:15.561Z",
"dateUpdated": "2026-10-20T22:45:09.343Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-113704 (GCVE-0-2026-113704)
Vulnerability from cvelistv5 – Published: 2026-10-20 22:00 – Updated: 2026-10-21 15:51 X_Open Source
VLAI
EPSS
VEX
Title
a2aproject a2a-rs Push Notification push_notification_sender.rs HttpPushSender server-side request forgery
Summary
A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file crates/server/src/push_notification_sender.rs of the component Push Notification Handler. Such manipulation of the argument TaskPushNotificationConfig leads to server-side request forgery. The attack may be launched remotely. The name of the patch is 2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224. Applying a patch is advised to resolve this issue.
Severity
SSVC
Exploitation: none
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-21 14:40 UTC
CWE
- CWE-918 - Server-Side Request Forgery
Assigner
References
7 references
| URL | Tags |
|---|---|
| https://vuldb.com/vuln/422865 | vdb-entrytechnical-description |
| https://vuldb.com/vuln/422865/cti | signaturepermissions-required |
| https://vuldb.com/cve/CVE-2026-113704 | third-party-advisory |
| https://vuldb.com/submit/1014883 | third-party-advisory |
| https://github.com/a2aproject/a2a-rs/pull/124 | issue-trackingpatch |
| https://github.com/a2aproject/a2a-rs/commit/2ba50… | patch |
| https://github.com/a2aproject/a2a-rs/ | product |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| a2aproject | a2a-rs |
Affected:
0.4.0
Affected: 0.4.1 Affected: 0.4.2 Affected: 0.4.3 cpe:2.3:a:a2aproject:a2a-rs:*:*:*:*:*:*:*:* |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-113704",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-21T14:40:30.871594Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T15:51:31.062Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:a2aproject:a2a-rs:*:*:*:*:*:*:*:*"
],
"modules": [
"Push Notification Handler"
],
"product": "a2a-rs",
"vendor": "a2aproject",
"versions": [
{
"status": "affected",
"version": "0.4.0"
},
{
"status": "affected",
"version": "0.4.1"
},
{
"status": "affected",
"version": "0.4.2"
},
{
"status": "affected",
"version": "0.4.3"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "colorfullbz (VulDB User)"
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file crates/server/src/push_notification_sender.rs of the component Push Notification Handler. Such manipulation of the argument TaskPushNotificationConfig leads to server-side request forgery. The attack may be launched remotely. The name of the patch is 2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224. Applying a patch is advised to resolve this issue."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 6.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:OF/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-918",
"description": "Server-Side Request Forgery",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-20T22:00:25.887Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-422865 | a2aproject a2a-rs Push Notification push_notification_sender.rs HttpPushSender server-side request forgery",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/422865"
},
{
"name": "VDB-422865 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/422865/cti"
},
{
"name": "CVE-2026-113704 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-113704"
},
{
"name": "Submit #1014883 | a2aproject a2a-rs a2a-server-lf \u2264 0.4.3 SSRF",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1014883"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/a2aproject/a2a-rs/pull/124"
},
{
"tags": [
"patch"
],
"url": "https://github.com/a2aproject/a2a-rs/commit/2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224"
},
{
"tags": [
"product"
],
"url": "https://github.com/a2aproject/a2a-rs/"
}
],
"tags": [
"x_open-source"
],
"timeline": [
{
"lang": "en",
"time": "2026-10-20T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-20T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-20T18:02:40.000Z",
"value": "VulDB entry last update"
}
],
"title": "a2aproject a2a-rs Push Notification push_notification_sender.rs HttpPushSender server-side request forgery",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-113704",
"datePublished": "2026-10-20T22:00:25.887Z",
"dateReserved": "2026-10-20T15:57:11.575Z",
"dateUpdated": "2026-10-21T15:51:31.062Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}