Cleartext Credential Logging

A2A Java SDK is vulnerable to Cleartext Credential Logging. The vulnerability is due to improper error handling in RestHandler.parseRequestBody, where the method logs the full JSON request body at SEVERE level when JsonFormat.parser.merge throws InvalidProtocolBufferException, allowing an attacke...

CVE-2026-111762

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, RestHandler.parseRequestBody in transport/rest/src/main/java/org/a2aproject/sdk/transport/rest/handler/RestHandler.java logs the entire JSON request body at SEVERE level when JsonFormat.parser.merge thro...

CVE-2026-111762 A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, RestHandler.parseRequestBody in transport/rest/src/main/java/org/a2aproject/sdk/transport/rest/handler/RestHandler.java logs the entire JSON request body at SEVERE level when JsonFormat.parser.merge thro...

EUVD-2026-105044

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, RestHandler.parseRequestBody in transport/rest/src/main/java/org/a2aproject/sdk/transport/rest/handler/RestHandler.java logs the entire JSON request body at SEVERE level when JsonFormat.parser.merge thro...

CVE-2026-111762 A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, RestHandler.parseRequestBody in transport/rest/src/main/java/org/a2aproject/sdk/transport/rest/handler/RestHandler.java logs the entire JSON request body at SEVERE level when JsonFormat.parser.merge thro...

CVE-2026-111762

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, RestHandler.parseRequestBody in "transport/rest/src/main/java/org/a2aproject/sdk/transport/rest/handler/RestHandler.java" logs the entire JSON request body at SEVERE level when JsonFormat.parser.merge...

CVE-2026-111762 A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, RestHandler.parseRequestBody in transport/rest/src/main/java/org/a2aproject/sdk/transport/rest/handler/RestHandler.java logs the entire JSON request body at SEVERE level when JsonFormat.parser.merge thro...

CVE-2026-111762

The A2A Java SDK (Agent2Agent Protocol) is vulnerable in versions prior to 1.3.0.Final due to improper handling of failed protobuf deserialization in the RestHandler.parseRequestBody method. When JsonFormat.parser().merge() throws an InvalidProtocolBufferException, the application logs the entire...