CVE-2026-113705

Status: ReceivedMedium (6.9)—

Severity6.9Medium · CVSS 4.0

Exploitation probability—next 30 days

Active exploitationNonot in the CISA catalog

Public exploitNot knownno public code found

A vulnerability was determined in a2aproject a2a-rs up to 0.4.3. This issue affects some unknown processing of the file a2a-server/src/error.rs. Executing a manipulation can lead to information exposure through error message. The attack can be executed remotely. This patch is called 713b943af94ab2d521d483b841618b97a2e78a4d. A patch should be applied to remediate this issue.

CVSS

Base score: 6.9
Version: 4.0
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Exploitation probability (EPSS)

FIRST hasn't scored this CVE yet (usual for very recent or rejected CVEs).

EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).

ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1190 Exploit Public-Facing Applicationinitial access90 %
Primary impactT1005 Data from Local Systemcollection55 %

El vector AV:N/PR:N/UI:N indica explotación remota sin privilegios ni interacción; el texto describe exposición de información mediante mensajes de error, por lo que T1005 es una lectura de datos parcial.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

ATT&CK mitigations that cover these techniques

Vulnerability Scanning Privileged Account Management Network Segmentation Limit Access to Resource Over Network Filter Network Traffic Application Isolation and Sandboxing

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

A2aproject — A2a-rs^AI

CWEs

CWE-200, CWE-209

References

Show 7 references

Raw JSON (NVD)

Show

{
  "id": "CVE-2026-113705",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Secondary",
        "source": "cna@vuldb.com",
        "cvssData": {
          "version": "2.0",
          "baseScore": 5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "cna@vuldb.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.3,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 1.4,
        "exploitabilityScore": 3.9
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "cna@vuldb.com",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 6.9,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "NONE",
          "vulnIntegrityImpact": "NONE",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "cna@vuldb.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:a2aproject:a2a-rs:*:*:*:*:*:*:*:*"
          ],
          "vendor": "a2aproject",
          "product": "a2a-rs",
          "versions": [
            {
              "status": "affected",
              "version": "0.4.0"
            },
            {
              "status": "affected",
              "version": "0.4.1"
            },
            {
              "status": "affected",
              "version": "0.4.2"
            },
            {
              "status": "affected",
              "version": "0.4.3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2026-10-20T23:17:10.557",
  "references": [
    {
      "url": "https://github.com/a2aproject/a2a-rs/",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://github.com/a2aproject/a2a-rs/commit/713b943af94ab2d521d483b841618b97a2e78a4d",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://github.com/a2aproject/a2a-rs/pull/127",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/cve/CVE-2026-113705",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/submit/1014888",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/vuln/422867",
      "source": "cna@vuldb.com"
    },
    {
      "url": "https://vuldb.com/vuln/422867/cti",
      "source": "cna@vuldb.com"
    }
  ],
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "cna@vuldb.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        },
        {
          "lang": "en",
          "value": "CWE-209"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability was determined in a2aproject a2a-rs up to 0.4.3. This issue affects some unknown processing of the file a2a-server/src/error.rs. Executing a manipulation can lead to information exposure through error message. The attack can be executed remotely. This patch is called 713b943af94ab2d521d483b841618b97a2e78a4d. A patch should be applied to remediate this issue."
    }
  ],
  "lastModified": "2026-10-20T23:17:10.557",
  "sourceIdentifier": "cna@vuldb.com"
}