A flaw in the a2a‑java project’s JSON‑RPC error handling allows an attacker to trigger error messages that contain internal information. By manipulating the getMessage function, an attacker can remotely request detailed error text, exposing configuration details or stack traces. This constitutes an information‑exposure vulnerability (CWE‑200) and a form of information leakage (CWE‑209). The CVSS score of 5.3 indicates moderate severity; the affected code may reveal sensitive data to an unauthorized user.

The vulnerability affects a2aproject a2a‑java releases up through version 1.2.0.Final. The fix is released in version 1.3.0.Final, which includes the patch identified by commit SHA bbee3369f3825d0fba2373d821f6dc6d4fc82ec0. Systems that deploy earlier releases of a2a‑java and expose the JSON‑RPC interface are impacted. This includes any services or applications that rely on a2a‑java for cross‑application communication and publish a JSON‑RPC endpoint.

Attackers can exploit this flaw remotely by sending crafted JSON‑RPC requests to the vulnerable component; the attack does not require authentication if the interface is publicly reachable. The CEPS flags indicate that only the remote vector is available. The EPSS score is unavailable, but the CVSS score suggests a moderate risk. The vulnerability is not currently listed in the CISA KEV catalog, and no public exploit has been reported yet. Nevertheless, organizations that expose a2a‑java’s JSON‑RPC service should consider the risk of inadvertent disclosure of internal information when the interface is reachable from untrusted networks.