Read the docs
TI-2026-80570 Aliases CVE-2026-116479GHSA-rr3h-7mh5-mq8p

Information exposure in a2aproject a2a-java JSON-RPC error messages

Priority LOW 24CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

a2aproject a2a-java versions up to 1.2.0.Final expose sensitive information through error messages produced by the getMessage function of the JSON-RPC Error Handler, a flaw classified as CWE-209. A remote attacker with low privileges can read this information. The sources do not list active exploitation.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

A flaw has been found in a2aproject a2a-java up to 1.2.0.Final. This impacts the function getMessage of the component JSON-RPC Error Handler. This manipulation causes information exposure through error message. The attack can be initiated remotely. Upgrading to version 1.3.0.Final will fix this issue. Patch name: bbee3369f3825d0fba2373d821f6dc6d4fc82ec0. Upgrading the affected component is advised.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00315 24th percentileScored 2026-11-07
Fix Fixed a2a-java (a2aproject): 1.3.0.Final

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
a2aprojecta2a-java1.2.0.Final1.3.0.FinalPatch availableCNA
  • a2a-java Vendora2aproject Affected 1.2.0.Final Fixed in 1.3.0.Final Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:a2aproject:a2a-java:*:*:*:*:*:*:*:*——a2aproject
  • cpe:2.3:a:a2aproject:a2a-java:*:*:*:*:*:*:*:* Versions — — ·a2aproject

Remediation

Upgrade a2aproject a2a-java to version 1.3.0.Final, which fixes this issue. The vendor's patch is named bbee3369f3825d0fba2373d821f6dc6d4fc82ec0.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA a2a-java (a2aproject) Fixed in 1.3.0.Final

Timeline

  1. 2026-10-26 Threatist record created from CVE-2026-116479
  2. 2026-10-27 CISA SSVC decision points changed
  3. 2026-10-27 Alias added: GHSA-rr3h-7mh5-mq8p

References

Patch 3

Other 1

  • TI-2026-76905 Android A2A Java SDK forwards API keys across redirects CVSS 3.1HIGH 7.5
  • TI-2026-76904 A2A Java SDK default task store skips authorization on task reads CVSS 3.1HIGH 7.5
  • TI-2026-76847 Server-side request forgery in A2A Java SDK push notifications CVSS 3.1MEDIUM 5.8
  • TI-2026-81183 Resource consumption in a2aproject a2a-go REST SSE handler CVSS 4.0MEDIUM 6.9
  • TI-2026-61722 HTTP response splitting in a2aproject a2a-java CVSS 4.0MEDIUM 6.9
  • TI-2026-81185 Denial of service in a2aproject a2a-go Distributed Manager Cancel CVSS 4.0MEDIUM 6.9
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences