CVE-2026-116479

MediumCVSS 4.3/10Last modified Oct 27, 2026

Description

A flaw has been found in a2aproject a2a-java up to 1.2.0.Final. This impacts the function getMessage of the component JSON-RPC Error Handler. This manipulation causes information exposure through error message. The attack can be initiated remotely. Upgrading to version 1.3.0.Final will fix this issue. Patch name: bbee3369f3825d0fba2373d821f6dc6d4fc82ec0. Upgrading the affected component is advised.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-200 CWE-209

Affected software

Vendor	Product	Versions
a2aproject	a2a-java	1.2.0.Final

References

Timeline

Published: Oct 26, 2026
Last modified: Oct 27, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-116488.8Use after free in FullScreen in Google Chrome on Windows prior to 149.0.7827.103 allowed a remote attacker to potentially exploit heap corru CVE-2026-1164807.8Photoshop Desktop is affected by a Heap-based Buffer Overflow vulnerability that could result in arbitrary code execution in the context of CVE-2026-1164823.5A vulnerability has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. Affected is a CVE-2026-1164859.8danmu_api before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment c CVE-2026-1164864.5Objenesis before 3.6 contains a type confusion vulnerability that allows code in one class loader to substitute objects into another by expl CVE-2026-1164874.6NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains an out-of-bounds read vulnerability in USB_DeviceCdcRndisS CVE-2026-1164886.8NXP MCUXpresso SDK USB middleware (mcuxsdk-middleware-usb) before 2.13.0 contains a heap buffer overflow in host audio, video and CDC class CVE-2026-1164897.5Timescale pgvectorscale before 0.9.1 contains a type confusion vulnerability that allows low-privileged database users to corrupt memory by CVE-2026-116498.8Use after free in V8 in Google Chrome prior to 149.0.7827.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a cra CVE-2026-1164926.5Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that allows authenticated low-privileged users to read CRM Lead CVE-2026-1164975.5A NULL pointer dereference vulnerability was found in gssproxy. When a GSSX_INIT_SEC_CONTEXT request is received with the target_name field CVE-2026-1164998.4IBM Qiskit SDK 1.4.2 through 2.6.2 could allow a local attacker to execute arbitrary code due to deserialization of untrusted data.