A vulnerability exists in the a2a-rs project up to version 0.4.3 where manipulating the historyLength argument in the file a2a-server/src/task_store/inmemory.rs can cause unintended data leakage. The flaw allows an attacker to retrieve sensitive internal information. The CVSS score of 5.1 reflects a moderate severity with potential impact on confidentiality. The vulnerability is noted as remotely exploitable.

The affected vendor is a2aproject and the product is a2a-rs. All releases up to and including 0.4.3 are susceptible; later releases are presumed fixed. No additional version details are supplied by the CNA beyond the upper bound of 0.4.3.

The EPSS score is below 1 % and the CVE is not listed in CISA’s KEV catalog, indicating a low likelihood of widespread exploitation at present. Attackers can trigger the vulnerability from a remote context by supplying a crafted historyLength value, leading to disclosure of internal state. Given the moderate CVSS score and the remote nature of the attack, the risk to affected deployments is considered moderate pending patch deployment.