CVE-2026-116479: a2aproject a2a-java JSON-RPC Error getMessage information exposure
A flaw has been found in a2aproject a2a-java up to 1.2.0.Final. This impacts the function getMessage of the component JSON-RPC Error Handler. This manipulation causes information exposure through error message. The attack can be initiated remotely. Upgrading to version 1.3.0.Final will fix this issue. Patch name: bbee3369f3825d0fba2373d821f6dc6d4fc82ec0. Upgrading the affected component is advised.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
a2aproject a2a-javato a version that resolves this vulnerability.Fixed in 1.3.0.FinalPatch bbee3369f3825d0fba2373d821f6dc6d4fc82ec0
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments using a2aproject a2a-java versions up to 1.2.0.Final are affected, specifically where the JSON-RPC Error Handler's getMessage function can be reached.
What does an attacker need to exploit this issue?
The attack can be initiated remotely and requires low privileges. No user interaction is required.
What information could be exposed?
The issue exposes information through error messages generated by the JSON-RPC Error Handler. The available data does not identify the specific contents of the leaked messages.
How should this be remediated?
Upgrade a2aproject a2a-java to version 1.3.0.Final. The listed patch is bbee3369f3825d0fba2373d821f6dc6d4fc82ec0.