CVE-2026-113706

Estado: RecibidaMedia (5.1)—

Gravedad5.1Media · CVSS 4.0

Probabilidad de explotación—en los próximos 30 días

Explotación activaNono figura en el catálogo de CISA

Exploit públicoNo conocidosin código público localizado

Se ha identificado una vulnerabilidad en a2aproject a2a-rs hasta la versión 0.4.3. Se ve afectada una función no identificada del archivo a2a-server/src/task_store/inmemory.rs. La manipulación del argumento historyLength conduce a una fuga de información. El ataque puede llevarse a cabo de forma remota. El identificador del parche es 68f1b7e772ae5d6c9e581ac9b48bcddd10fe70eb. Para corregir este problema, se recomienda desplegar un parche.

Traducción automática del texto original de NVD (en inglés).

CVSS

Puntuación base: 5.1
Versión: 4.0
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Probabilidad de explotación (EPSS)

FIRST aún no ha puntuado esta CVE (habitual en CVEs muy recientes o rechazadas).

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1203 Exploitation for Client Executionexecution60 %
Impacto principalT1005 Data from Local Systemcollection55 %

Inferido por reglas deterministas a partir del vector CVSS y la CWE. Solo orientativo.

Mitigaciones ATT&CK que cubren estas técnicas

Application Isolation and Sandboxing Exploit Protection Update Software Data Loss Prevention

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

A2aproject — A2a-rs^AI

CWE

CWE-200, CWE-284

Referencias

Mostrar las 7 referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-113706",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Secondary",
        "source": "cna@vuldb.com",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "cna@vuldb.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.5,
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 2.1
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "cna@vuldb.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 5.1,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "PASSIVE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "LOW",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "cna@vuldb.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:a2aproject:a2a-rs:*:*:*:*:*:*:*:*"
          ],
          "vendor": "a2aproject",
          "product": "a2a-rs",
          "versions": [
            {
              "status": "affected",
              "version": "0.4.0"
            },
            {
              "status": "affected",
              "version": "0.4.1"
            },
            {
              "status": "affected",
              "version": "0.4.2"
            },
            {
              "status": "affected",
              "version": "0.4.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-21T00:17:48.957",
  "references": [
    {
      "url": "https://github.com/a2aproject/a2a-rs/",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://github.com/a2aproject/a2a-rs/commit/68f1b7e772ae5d6c9e581ac9b48bcddd10fe70eb",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://github.com/a2aproject/a2a-rs/pull/122",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/cve/CVE-2026-113706",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/submit/1015040",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/vuln/422868",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/vuln/422868/cti",
      "source": "cna@vuldb.com"
    }
  ],
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "cna@vuldb.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        },
        {
          "lang": "en",
          "value": "CWE-284"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability was identified in a2aproject a2a-rs up to 0.4.3. Impacted is an unknown function of the file a2a-server/src/task_store/inmemory.rs. The manipulation of the argument historyLength leads to information disclosure. The attack is possible to be carried out remotely. The identifier of the patch is 68f1b7e772ae5d6c9e581ac9b48bcddd10fe70eb. To fix this issue, it is recommended to deploy a patch."
    }
  ],
  "lastModified": "2026-10-21T00:17:48.957",
  "sourceIdentifier": "cna@vuldb.com"
}