The vulnerability arises in a2aproject a2a-rs up to version 0.4.3, caused by improper handling of errors in the file a2a-server/src/error.rs. A crafted input that triggers the error handling logic can cause the server to output an error message containing sensitive information. This results in information disclosure, compromising the confidentiality of data that may be transmitted or stored by the system.

The affected product is a2a-rs from a2aproject. Versions up to and including 0.4.3 are impacted. Users running any 0.4.x release prior to the fix are at risk.

The CVSS score of 6.9 classifies the issue as medium severity. The EPSS score of less than 1% indicates a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attack can be executed remotely by sending a manipulated request that triggers the error handler and reveals sensitive information through the returned error message. No special privilege or local access is needed, which lowers the barrier for an attacker. Security teams should monitor for suspicious error logs and apply mitigations promptly.