a2a-rs CVE-2026-113705

The disclosure occurs only when the server itself hits an internal error whose detailed message was previously returned to the client unsanitized - specifically serialization/ProtoJSON stream serialization faults, HttpPushSender failures, extended-agent-card handler faults, or broadcast subscription lag - all of which pre-patch surfaced the raw internal detail (the tests reference leaked strings such as a filesystem path like /etc/server/keys.pem). Exploitation is remote and unauthenticated (PR:N), but is LIMITED by the need to actually induce one of these internal fault conditions and by the fact that only low-sensitivity diagnostic/implementation detail is exposed (VC:L), not guaranteed credentials or user data. Affects a2a-rs 0.4.0 through 0.4.3 running the a2a-server component; fixed by the sanitized_internal_error change.

All signals point to a genuine but modest-severity information-disclosure issue rather than a top-tier priority. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L, score 6.9) indicates a remotely reachable, low-complexity, unauthenticated flaw, but with only LOW confidentiality impact and no integrity or availability impact (VI:N/VA:N) - consistent with leaking internal error detail rather than sensitive secrets. There is NO CISA KEV listing and NO public exploit code referenced in the data, so exploitation status is 'no public exploit identified at time of analysis'. No EPSS score was provided, so exploitation probability cannot be quantified. The SSVC framework data (exploitation/automatable/technical-impact) was not supplied. The 6.9 base score is somewhat inflated for what the source evidence shows is disclosure of server-side diagnostic strings (serialization faults, internal file paths); the CWE-209 class remediation (sanitizing INTERNAL_ERROR messages) confirms the real-world impact is diagnostic leakage, which is a hardening/defense-in-depth issue more than a critical breach vector. Net: real but low-urgency - patch during normal maintenance, not an emergency.

A remote, unauthenticated attacker sends malformed or edge-case requests to the a2a-rs server's JSON-RPC or REST endpoints to force an internal server fault (e.g., a payload serialization failure, a push-notification sender error, or a broadcast subscription that falls behind). Pre-patch, the server returned the raw internal error message verbatim to the client, potentially exposing server-side detail such as internal file paths or implementation state. No public proof-of-concept is referenced in the provided data.