CVE-2026-113704 a2aproject a2a-rs Push Notification push_notification_sender.rs HttpPushSender server-side request forgery

A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file crates/server/src/pushnotificationsender.rs of the component Push Notification Handler. Such manipulation of the argument TaskPushNotificationConfig leads to server-side request...

CVE-2026-113704

A vulnerability exists in a2aproject a2a-rs up to version 0.4.3 within the Push Notification Handler component. Specifically, the HttpPushSender function in the file crates/server/src/push_notification_sender.rs is susceptible to server-side request forgery (SSRF) due to the manipulation of the T...

CVE-2026-113704 a2aproject a2a-rs Push Notification push_notification_sender.rs HttpPushSender server-side request forgery

A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file crates/server/src/pushnotificationsender.rs of the component Push Notification Handler. Such manipulation of the argument TaskPushNotificationConfig leads to server-side request...

CVE-2026-113704 a2aproject a2a-rs Push Notification push_notification_sender.rs HttpPushSender server-side request forgery

A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file crates/server/src/pushnotificationsender.rs of the component Push Notification Handler. Such manipulation of the argument TaskPushNotificationConfig leads to server-side request...

CVE-2026-111761

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, BasePushNotificationSender in server-common sends task data to the URL in TaskPushNotificationConfig without destination validation, scheme restrictions, or bounds on redirects...

CVE-2026-111761 A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, BasePushNotificationSender in server-common sends task data to the URL in TaskPushNotificationConfig without destination validation, scheme restrictions, or bounds on redirects...

EUVD-2026-105043

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, BasePushNotificationSender in server-common sends task data to the URL in TaskPushNotificationConfig without destination validation, scheme restrictions, or bounds on redirects...

Agent2Agent A2A Rust SDK server request forgery vulnerability

The Agent2Agent A2A Rust SDK 0.4.3 and earlier versions have a vulnerability related to server-side request forgery. This vulnerability stems from improper handling of parameters in the HttpPushSender function of the Push Notification Handler component. The improper handling involves the paramete...