PT-2026-126613

A security vulnerability has been detected in a2aproject a2a-java up to 1.2.0.Final. This impacts the function TaskManager.saveTaskEvent. The manipulation leads to race condition. The attack may be initiated remotely. Upgrading to version 1.3.0.Final will fix this issue. The identifier of the pat...

PT-2026-126611

A security flaw has been discovered in a2aproject a2a-java up to 1.2.0.Final. The impacted element is the function queue.offer of the component ChildQueue. Performing a manipulation results in resource consumption. The attack can be initiated remotely. Upgrading to version 1.3.0.Final is sufficie...

CVE-2026-116479

A flaw has been found in a2aproject a2a-java up to 1.2.0.Final. This impacts the function getMessage of the component JSON-RPC Error Handler. This manipulation causes information exposure through error message. The attack can be initiated remotely. Upgrading to version 1.3.0.Final will fix this...

CVE-2026-116479

The a2aproject a2a-java software, versions up to 1.2.0.Final , contains a vulnerability in the JSON-RPC Error Handler component. Specifically, the getMessage function can be manipulated to cause information exposure via error messages. This flaw can be triggered remotely. To remediate this issue,...

CVE-2026-116479 a2aproject a2a-java JSON-RPC Error getMessage information exposure

A flaw has been found in a2aproject a2a-java up to 1.2.0.Final. This impacts the function getMessage of the component JSON-RPC Error Handler. This manipulation causes information exposure through error message. The attack can be initiated remotely. Upgrading to version 1.3.0.Final will fix this...

CVE-2026-116479

A flaw has been found in a2aproject a2a-java up to 1.2.0.Final. This impacts the function getMessage of the component JSON-RPC Error Handler. This manipulation causes information exposure through error message. The attack can be initiated remotely. Upgrading to version 1.3.0.Final will fix this...

CVE-2026-116479 a2aproject a2a-java JSON-RPC Error getMessage information exposure

A flaw has been found in a2aproject a2a-java up to 1.2.0.Final. This impacts the function getMessage of the component JSON-RPC Error Handler. This manipulation causes information exposure through error message. The attack can be initiated remotely. Upgrading to version 1.3.0.Final will fix this...

EUVD-2026-110079

A flaw has been found in a2aproject a2a-java up to 1.2.0.Final. This impacts the function getMessage of the component JSON-RPC Error Handler. This manipulation causes information exposure through error message. The attack can be initiated remotely. Upgrading to version 1.3.0.Final will fix this...

CVE-2026-116479 a2aproject a2a-java JSON-RPC Error getMessage information exposure

A flaw has been found in a2aproject a2a-java up to 1.2.0.Final. This impacts the function getMessage of the component JSON-RPC Error Handler. This manipulation causes information exposure through error message. The attack can be initiated remotely. Upgrading to version 1.3.0.Final will fix this...

PT-2026-125105

A flaw has been found in a2aproject a2a-java up to 1.2.0.Final. This impacts the function getMessage of the component JSON-RPC Error Handler. This manipulation causes information exposure through error message. The attack can be initiated remotely. Upgrading to version 1.3.0.Final will fix this...

Server-Side Request Forgery (SSRF)

A2A Java SDK is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of push notification destination URLs and unrestricted redirect handling, which allows an unauthenticated attacker to make the server send HTTP requests to internal or restricted...

Cleartext Credential Logging

A2A Java SDK is vulnerable to Cleartext Credential Logging. The vulnerability is due to improper error handling in RestHandler.parseRequestBody, where the method logs the full JSON request body at SEVERE level when JsonFormat.parser.merge throws InvalidProtocolBufferException, allowing an attacke...

A2A Java SDK Has Server-Side Request Forgery (SSRF) In Push-notification Delivery

- Ecosystem: Maven - Affected package: "org.a2aproject.sdk:a2a-java-sdk-server-common" push-notification delivery - Affected versions: "= 1.2.0.Final" and "1.2.1.Final-SNAPSHOT" on "main" prior to the fix - Patched version: the release that carries the fix - CWE: CWE-918 Server-Side Request...

Exposure Of Sensitive Information

A2A Java SDK is vulnerable to Exposure of Sensitive Information. The vulnerability is due to failure to validate the API key's declared location and prevent credential-bearing custom headers from being forwarded across cross-origin redirects, which allows a malicious or compromised remote agent t...

Exposure Of Sensitive Information

A2A Java SDK is vulnerable to Exposure of Sensitive Information. The vulnerability is due to improper redirect handling in the Android HTTP client's synchronous POST requests, which allows an attacker controlling a redirected destination to obtain configured API keys or authentication tokens...

GHSA-X32G-JVVM-4725 A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure

Impact. Push notification bearer tokens and authentication credentials submitted by clients are written to server log files in cleartext. Any operator, log aggregation system, or attacker with log access can read these secrets and use them to authenticate to the client's push notification...

A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure

Impact. Push notification bearer tokens and authentication credentials submitted by clients are written to server log files in cleartext. Any operator, log aggregation system, or attacker with log access can read these secrets and use them to authenticate to the client's push notification...

io.github.zhoujie628:workflow-exec-engine-spring-boot-starter (0.0.1), net.openan.a2a-t.sdk:a2a-t-sample (>=0.0.1, <=1.1.1) +16 more potentially affected by CVE-2026-111762 via org.a2aproject.sdk:a2a-java-sdk-transport-rest (>=1.0.0.alpha4, <=1.2.0.final)

org.a2aproject.sdk:a2a-java-sdk-transport-rest MAVEN version =1.0.0.alpha4, =0.0.1, =0.0.1, =0.0.1, =1.0.0.final, =1.0.0.cr1, =1.0.0.alpha4, =1.0.0.cr1, =1.0.0.cr1, =1.0.0.cr1, =1.0.0.cr4 - org.wildfly.a2a:a2a-jakarta-rest-web 1.0.0.cr1 and more Source cves: CVE-2026-111762 Source advisory:...

io.github.zhoujie628:workflow-exec-engine-spring-boot-starter (0.0.1), net.openan.a2a-t.sdk:a2a-t-sample (>=0.0.1, <=1.1.1) +16 more potentially affected by CVE-2026-111762 via org.a2aproject.sdk:a2a-java-sdk-transport-rest (>=1.0.0.alpha4, <=1.2.0.final)

org.a2aproject.sdk:a2a-java-sdk-transport-rest MAVEN version =1.0.0.alpha4, =0.0.1, =0.0.1, =0.0.1, =1.0.0.final, =1.0.0.cr1, =1.0.0.alpha4, =1.0.0.cr1, =1.0.0.cr1, =1.0.0.cr1, =1.0.0.cr4 - org.wildfly.a2a:a2a-jakarta-rest-web 1.0.0.cr1 and more Source cves: CVE-2026-111762 Source advisory:...

GHSA-4FPJ-G9JF-9RGG A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix

The GHSA-9rhm fix added this safe setting in AndroidA2AHttpClient.createConnection: connection.setInstanceFollowRedirectsfalse; The synchronous POST builder later overwrites it: private boolean followRedirects = true; public A2AHttpResponse post throws IOException HttpURLConnection connection =...