Quick answers
- Is CVE-2026-113705 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-113705 being exploited in the wild.
- How severe is CVE-2026-113705?
- Medium severity, with a CVSS score of 5.3, published 20 October 2026.
- Which products and versions are affected?
- A2aproject A2a-Rs up to 0.4.3.
- Is there a fix for CVE-2026-113705?
- Yes: fixed in a2a-rs 0.4.4 or later (commit 713b943af94ab2d521d483b841618b97a2e78a4d). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-113705 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-113705?
- Check whether you run A2aproject A2a-Rs at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: a2a-rs 0.4.4 or later (commit 713b943af94ab2d521d483b841618b97a2e78a4d)
Technical details
The vulnerability in a2a-server/src/error.rs allows internal error messages to be transmitted unfiltered to clients over the network. The issue affects error handling in the server component, where detailed error context that should remain internal is exposed in responses. The fix sanitizes error messages at the response boundary and at raise sites before transmission to clients.
Affected products
- a2aproject a2a-rs up to 0.4.3
Timeline
- 2026-10-20: disclosed
- 2026-09-24: patched: Fix committed as 713b943af94ab2d521d483b841618b97a2e78a4d