CVE-2026-111761

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, BasePushNotificationSender in server-common sends task data to the URL in TaskPushNotificationConfig without destination validation, scheme restrictions, or bounds on redirects...