CVE-2026-116479 a2aproject a2a-java JSON-RPC Error getMessage information exposure

Medium 5.3 Published 26 Oct 2026 Updated 27 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-116479?

CVE-2026-116479 is a medium-severity vulnerability in a2aproject a2a-java, published on 26 Oct 2026.

Official description

A flaw has been found in a2aproject a2a-java up to 1.2.0.Final. This impacts the function getMessage of the component JSON-RPC Error Handler. This manipulation causes information exposure through error message. The attack can be initiated remotely. Upgrading to version 1.3.0.Final will fix this issue. Patch name: bbee3369f3825d0fba2373d821f6dc6d4fc82ec0. Upgrading the affected component is advised.

Weakness: CWE-209, CWE-200

Which versions are affected by CVE-2026-116479?

How do I fix CVE-2026-116479?

No fix has been published for CVE-2026-116479 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-116479 being exploited?

There is no known exploitation of CVE-2026-116479 in the wild and no public exploit code.

Sources

Also known as GHSA-rr3h-7mh5-mq8p.