A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix

The GHSA-9rhm fix added this safe setting in AndroidA2AHttpClient.createConnection: connection.setInstanceFollowRedirectsfalse; The synchronous POST builder later overwrites it: private boolean followRedirects = true; public A2AHttpResponse post throws IOException HttpURLConnection connection =...

GHSA-4FPJ-G9JF-9RGG A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix

The GHSA-9rhm fix added this safe setting in AndroidA2AHttpClient.createConnection: connection.setInstanceFollowRedirectsfalse; The synchronous POST builder later overwrites it: private boolean followRedirects = true; public A2AHttpResponse post throws IOException HttpURLConnection connection =...

EUVD-2026-105136

A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix...

CVE-2026-111765

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Starting in version 1.3.0.Final and prior to version 1.3.2.Final, the AndroidA2AHttpClient synchronous POST path overrides the disabled-redirect setting in AndroidA2AHttpClient.createConnection with the PostBuilder default...

CVE-2026-111765

The A2A Java SDK (official Java SDK for the Agent2Agent Protocol) is vulnerable in versions 1.3.0.Final and prior to 1.3.2.Final . The AndroidA2AHttpClient synchronous POST path improperly overrides the disabled-redirect setting, allowing followRedirects to default to true . This causes the SDK t...

CVE-2026-111765 A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Starting in version 1.3.0.Final and prior to version 1.3.2.Final, the AndroidA2AHttpClient synchronous POST path overrides the disabled-redirect setting in AndroidA2AHttpClient.createConnection with the PostBuilder default...