org.a2aproject.sdk:a2a-java-sdk-examples-cloud-deployment-server (>=1.0.0.alpha4, <=1.2.0.final) potentially affected by CVE-2026-117506 via org.a2aproject.sdk:a2a-java-extras-push-notification-config-store-database-jpa (>=1.0.0.alpha4, <=1.2.0.final)

org.a2aproject.sdk:a2a-java-extras-push-notification-config-store-database-jpa MAVEN version =1.0.0.alpha4, =1.0.0.alpha4, =1.2.0.final Source cves: CVE-2026-117506 Source advisory: MEND:CVE-2026-117506...

Agent2Agent A2A Java SDK resource management error vulnerability

Agent2Agent A2A Java SDK versions 1.2.0.Final and earlier contain a resource management error vulnerability. This vulnerability arises from excessive resource consumption caused by operations in the queue.offer function within the ChildQueue component; attackers can exploit this to launch remote...

Agent2Agent A2A Java SDK race condition vulnerability

Agent2Agent A2A Java SDK versions 1.2.0.Final and earlier contain a race condition vulnerability. This vulnerability arises from a race condition occurring during the execution of the TaskManager.saveTaskEvent function, allowing attackers to launch remote attacks...

Agent2Agent A2A Java SDK resource management error vulnerability

Agent2Agent A2A Java SDK versions 1.2.0.Final and earlier contain a resource management error vulnerability. This vulnerability stems from improper handling in the InMemoryPushNotificationConfigStore.setInfo function within the Push Notification Config Store component. Specifically, it involves...

io.github.zhoujie628:workflow-exec-engine-spring-boot-starter (0.0.1), net.openan.a2a-t.sdk:a2a-t-sample (>=0.0.1, <=1.1.1) +16 more potentially affected by CVE-2026-116479 via org.a2aproject.sdk:a2a-java-sdk-transport-rest (>=1.0.0.alpha4, <=1.2.0.final)

org.a2aproject.sdk:a2a-java-sdk-transport-rest MAVEN version =1.0.0.alpha4, =0.0.1, =0.0.1, =0.0.1, =1.0.0.final, =1.0.0.cr1, =1.0.0.alpha4, =1.0.0.cr1, =1.0.0.cr1, =1.0.0.cr1, =1.0.0.cr4 - org.wildfly.a2a:a2a-jakarta-rest-web 1.0.0.cr1 and more Source cves: CVE-2026-116479 Source advisory:...

net.openan.a2a-t.sdk:a2a-t-sample (>=0.0.1, <=0.1.8), org.a2aproject.sdk:a2a-java-sdk-itk (>=1.0.0.final, <=1.1.0.final) +5 more potentially affected by CVE-2026-116479 via org.a2aproject.sdk:a2a-java-sdk-reference-rest (>=1.0.0.alpha4, <=1.2.0.final)

org.a2aproject.sdk:a2a-java-sdk-reference-rest MAVEN version =1.0.0.alpha4, =0.0.1, =1.0.0.final, =1.0.0.cr1, =1.0.0.cr1, =1.0.0.cr1, =1.2.0.final - org.a2aproject.sdk:a2a-tck-server 1.0.0.alpha4 - org.qubership.integration.platform:qip-ai-service 1.5.2 Source cves: CVE-2026-116479 Source advisor...

org.a2aproject.sdk:a2a-java-queue-manager-replicated-tests-multi-instance-app-1 (>=1.0.0.alpha4, <=1.2.0.final), org.a2aproject.sdk:a2a-java-queue-manager-replicated-tests-multi-instance-app-2 (>=1.0.0.alpha4, <=1.2.0.final) +9 more potentially affected by CVE-2026-116479 via org.a2aproject.sdk:a2a-java-sdk-reference-jsonrpc (>=1.0.0.alpha4, <=1.2.0.final)

org.a2aproject.sdk:a2a-java-sdk-reference-jsonrpc MAVEN version =1.0.0.alpha4, =1.0.0.alpha4, =1.0.0.alpha4, =1.0.0.alpha4, =1.0.0.alpha4, =1.0.0.final, =1.0.0.alpha4, =1.0.0.cr1, =1.0.0.cr1, =1.0.0.cr1, =1.2.0.final - org.a2aproject.sdk:a2a-tck-server 1.0.0.alpha4 -...

org.a2aproject.sdk:a2a-java-sdk-itk (>=1.0.0.final, <=1.1.0.final), org.a2aproject.sdk:a2a-java-sdk-reference-grpc (>=1.0.0.alpha4, <=1.2.0.final) +8 more potentially affected by CVE-2026-116479 via org.a2aproject.sdk:a2a-java-sdk-transport-grpc (>=1.0.0.alpha4, <=1.2.0.final)

org.a2aproject.sdk:a2a-java-sdk-transport-grpc MAVEN version =1.0.0.alpha4, =1.0.0.final, =1.0.0.alpha4, =1.0.0.cr1, =1.0.0.cr1, =1.0.0.cr1, =1.0.0.cr1, =1.0.0.cr2 - org.wildfly.a2a:a2a-java-sdk-jakarta-grpc 1.0.0.beta1 - org.wildfly.a2a:a2a-java-sdk-jakarta-tck-wildfly 1.0.0.beta1 Source cves:...

Agent2Agent A2A Java SDK information disclosure vulnerability

Agent2Agent A2A Java SDK versions 1.2.0.Final and earlier contain an information disclosure vulnerability. This vulnerability stems from improper handling of the getMessage function within the JSON-RPC Error Handler component; it may lead to information leakage via error messages, allowing...

Server-Side Request Forgery (SSRF)

A2A Java SDK is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of push notification destination URLs and unrestricted redirect handling, which allows an unauthenticated attacker to make the server send HTTP requests to internal or restricted...

Cleartext Credential Logging

A2A Java SDK is vulnerable to Cleartext Credential Logging. The vulnerability is due to improper error handling in RestHandler.parseRequestBody, where the method logs the full JSON request body at SEVERE level when JsonFormat.parser.merge throws InvalidProtocolBufferException, allowing an attacke...

A2A Java SDK Has Server-Side Request Forgery (SSRF) In Push-notification Delivery

- Ecosystem: Maven - Affected package: "org.a2aproject.sdk:a2a-java-sdk-server-common" push-notification delivery - Affected versions: "= 1.2.0.Final" and "1.2.1.Final-SNAPSHOT" on "main" prior to the fix - Patched version: the release that carries the fix - CWE: CWE-918 Server-Side Request...

Exposure Of Sensitive Information

A2A Java SDK is vulnerable to Exposure of Sensitive Information. The vulnerability is due to failure to validate the API key's declared location and prevent credential-bearing custom headers from being forwarded across cross-origin redirects, which allows a malicious or compromised remote agent t...

Exposure Of Sensitive Information

A2A Java SDK is vulnerable to Exposure of Sensitive Information. The vulnerability is due to improper redirect handling in the Android HTTP client's synchronous POST requests, which allows an attacker controlling a redirected destination to obtain configured API keys or authentication tokens...

io.github.zhoujie628:workflow-exec-engine-spring-boot-starter (0.0.1), net.openan.a2a-t.sdk:a2a-t-sample (>=0.0.1, <=1.1.1) +16 more potentially affected by CVE-2026-111762 via org.a2aproject.sdk:a2a-java-sdk-transport-rest (>=1.0.0.alpha4, <=1.2.0.final)

org.a2aproject.sdk:a2a-java-sdk-transport-rest MAVEN version =1.0.0.alpha4, =0.0.1, =0.0.1, =0.0.1, =1.0.0.final, =1.0.0.cr1, =1.0.0.alpha4, =1.0.0.cr1, =1.0.0.cr1, =1.0.0.cr1, =1.0.0.cr4 - org.wildfly.a2a:a2a-jakarta-rest-web 1.0.0.cr1 and more Source cves: CVE-2026-111762 Source advisory:...

io.github.zhoujie628:workflow-exec-engine-spring-boot-starter (0.0.1), net.openan.a2a-t.sdk:a2a-t-sample (>=0.0.1, <=1.1.1) +16 more potentially affected by CVE-2026-111762 via org.a2aproject.sdk:a2a-java-sdk-transport-rest (>=1.0.0.alpha4, <=1.2.0.final)

org.a2aproject.sdk:a2a-java-sdk-transport-rest MAVEN version =1.0.0.alpha4, =0.0.1, =0.0.1, =0.0.1, =1.0.0.final, =1.0.0.cr1, =1.0.0.alpha4, =1.0.0.cr1, =1.0.0.cr1, =1.0.0.cr1, =1.0.0.cr4 - org.wildfly.a2a:a2a-jakarta-rest-web 1.0.0.cr1 and more Source cves: CVE-2026-111762 Source advisory:...

A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure

Impact. Push notification bearer tokens and authentication credentials submitted by clients are written to server log files in cleartext. Any operator, log aggregation system, or attacker with log access can read these secrets and use them to authenticate to the client's push notification...

GHSA-X32G-JVVM-4725 A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure

Impact. Push notification bearer tokens and authentication credentials submitted by clients are written to server log files in cleartext. Any operator, log aggregation system, or attacker with log access can read these secrets and use them to authenticate to the client's push notification...

A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix

The GHSA-9rhm fix added this safe setting in AndroidA2AHttpClient.createConnection: connection.setInstanceFollowRedirectsfalse; The synchronous POST builder later overwrites it: private boolean followRedirects = true; public A2AHttpResponse post throws IOException HttpURLConnection connection =...

GHSA-4FPJ-G9JF-9RGG A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix

The GHSA-9rhm fix added this safe setting in AndroidA2AHttpClient.createConnection: connection.setInstanceFollowRedirectsfalse; The synchronous POST builder later overwrites it: private boolean followRedirects = true; public A2AHttpResponse post throws IOException HttpURLConnection connection =...