GHSA-Q78C-5JJQ-57G8 A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery

--- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common push-notification delivery - Affected versions: = 1.2.0.Final and 1.2.1.Final-SNAPSHOT on main prior to the fix - Patched version: the release that carries the fix - CWE: CWE-918 Server-Side Request Forgery -...

EUVD-2026-105043

A2A Java SDK has Server-Side Request Forgery SSRF in push-notification delivery...

A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery

--- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common push-notification delivery - Affected versions: = 1.2.0.Final and 1.2.1.Final-SNAPSHOT on main prior to the fix - Patched version: the release that carries the fix - CWE: CWE-918 Server-Side Request Forgery -...

GHSA-QW47-MCM5-934W A2A Java SDK has a fail-open default task authorization

Draft text for GHSA-qw47-mcm5-934w. The body below drops into the GitHub advisory description field; the metadata block maps to the form fields. Set the patched version at release; publish when the fix ships. --- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common...

A2A Java SDK has a fail-open default task authorization

Draft text for GHSA-qw47-mcm5-934w. The body below drops into the GitHub advisory description field; the metadata block maps to the form fields. Set the patched version at release; publish when the fix ships. --- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common...

CVE-2026-111761

A2A Java SDK is the official Java SDK for the Agent2Agent A2A Protocol. Prior to 1.3.0.Final, BasePushNotificationSender in server-common sends task data to the URL in TaskPushNotificationConfig without destination validation, scheme restrictions, or bounds on redirects...

io.agntcy.slim:slim-a2a-java (>=0.1.1, <=0.4.2), io.github.sh1bari:a2a-spring-boot-server-autoconfigure (>=0.1.0, <=0.1.2) +49 more potentially affected by CVE-2026-90820 via org.a2aproject.sdk:a2a-java-sdk-server-common (>=1.1.0.final, <=1.2.0.final)

org.a2aproject.sdk:a2a-java-sdk-server-common MAVEN version =1.1.0.final, =0.1.1, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.0.1, =1.1.0.final, =1.1.0.final, =1.1.0.final, =1.1.0.final, =1.1.0.final, =1.1.0.final, =1.1.0.final, =1.1.0.final, =1.2.0.fina...

com.flipkart.krystal:lattice-a2a-codegen (>=0.2.1.2-alpha, <=0.6.12), com.openjiuwen:adapter-versatile-agent-java (>=0.1.0, <=0.1.2) +72 more potentially affected by CVE-2026-90819 via org.a2aproject.sdk:a2a-java-sdk-server-common (>=1.0.0.alpha4, <=1.2.0.final)

org.a2aproject.sdk:a2a-java-sdk-server-common MAVEN version =1.0.0.alpha4, =0.2.1.2-alpha, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.1, =0.1.0, =0.1.1, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =1.1.1 and more Source cves: CVE-2026-90819 Source advisory: MEND:CVE-2026-90819...

org.cometd.java:cometd-java-annotation-server (>=5.0.0, <=5.0.22), org.cometd.java:cometd-java-benchmark-server (>=5.0.0, <=5.0.22) +8 more potentially affected by CVE-2025-53114 via org.cometd.java:cometd-java-server-common (>=5.0.0, <=5.0.22)

org.cometd.java:cometd-java-server-common MAVEN version =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.2, =5.0.22 Source cves: CVE-2025-53114 Source advisory: MEND:CVE-2025-53114...

org.apache.camel.quarkus:camel-quarkus-cometd (>=3.0.0-m1, <=3.6.0), org.apache.camel.quarkus:camel-quarkus-cometd-deployment (>=3.0.0-m1, <=3.6.0) +13 more potentially affected by CVE-2025-53114 via org.cometd.java:cometd-java-server-common (>=7.0.0, <=7.0.18)

org.cometd.java:cometd-java-server-common MAVEN version =7.0.0, =3.0.0-m1, =3.0.0-m1, =3.0.0-m1, =4.0.0-m1, =4.0.0-m1, =7.0.0, =7.0.0, =7.0.0, =7.0.11, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.18 Source cves: CVE-2025-53114 Source advisory: MEND:CVE-2025-53114...

org.apache.camel.karaf:camel-cometd (>=4.7.0, <=4.10.7), org.apache.camel.quarkus:camel-quarkus-cometd (>=3.13.0, <=3.25.0) +13 more potentially affected by CVE-2025-53114 via org.cometd.java:cometd-java-server-common (>=8.0.0, <=8.0.8)

org.cometd.java:cometd-java-server-common MAVEN version =8.0.0, =4.7.0, =3.13.0, =3.13.0, =4.7.0, =4.7.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.8 Source cves: CVE-2025-53114 Source advisory: MEND:CVE-2025-53114...

org.cometd.java:cometd-java-annotation-server (>=6.0.0, <=6.0.18), org.cometd.java:cometd-java-benchmark-server (>=6.0.0, <=6.0.18) +8 more potentially affected by CVE-2025-53114 via org.cometd.java:cometd-java-server-common (>=6.0.0, <=6.0.18)

org.cometd.java:cometd-java-server-common MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.18 Source cves: CVE-2025-53114 Source advisory: MEND:CVE-2025-53114...

org.cometd.java:cometd-java-annotation-server (>=5.0.0, <=5.0.22), org.cometd.java:cometd-java-benchmark-server (>=5.0.0, <=5.0.22) +8 more potentially affected by CVE-2025-53114 via org.cometd.java:cometd-java-server-common (>=5.0.0, <=5.0.22)

org.cometd.java:cometd-java-server-common MAVEN version =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.2, =5.0.22 Source cves: CVE-2025-53114 Source advisory: GHSA-CQGJ-H8VF-4W59...

org.apache.camel.karaf:camel-cometd (>=4.7.0, <=4.10.7), org.apache.camel.quarkus:camel-quarkus-cometd (>=3.13.0, <=3.25.0) +13 more potentially affected by CVE-2025-53114 via org.cometd.java:cometd-java-server-common (>=8.0.0, <=8.0.8)

org.cometd.java:cometd-java-server-common MAVEN version =8.0.0, =4.7.0, =3.13.0, =3.13.0, =4.7.0, =4.7.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.8 Source cves: CVE-2025-53114 Source advisory: GHSA-CQGJ-H8VF-4W59...

org.apache.camel.quarkus:camel-quarkus-cometd (>=3.0.0-m1, <=3.6.0), org.apache.camel.quarkus:camel-quarkus-cometd-deployment (>=3.0.0-m1, <=3.6.0) +13 more potentially affected by CVE-2025-53114 via org.cometd.java:cometd-java-server-common (>=7.0.0, <=7.0.18)

org.cometd.java:cometd-java-server-common MAVEN version =7.0.0, =3.0.0-m1, =3.0.0-m1, =3.0.0-m1, =4.0.0-m1, =4.0.0-m1, =7.0.0, =7.0.0, =7.0.0, =7.0.11, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.18 Source cves: CVE-2025-53114 Source advisory: GHSA-CQGJ-H8VF-4W59...

org.cometd.java:cometd-java-annotation-server (>=6.0.0, <=6.0.18), org.cometd.java:cometd-java-benchmark-server (>=6.0.0, <=6.0.18) +8 more potentially affected by CVE-2025-53114 via org.cometd.java:cometd-java-server-common (>=6.0.0, <=6.0.18)

org.cometd.java:cometd-java-server-common MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.18 Source cves: CVE-2025-53114 Source advisory: GHSA-CQGJ-H8VF-4W59...

org.cometd.java:cometd-java-annotation-server (>=5.0.0, <=5.0.22), org.cometd.java:cometd-java-benchmark-server (>=5.0.0, <=5.0.22) +8 more potentially affected by CVE-2025-53114 via org.cometd.java:cometd-java-server-common (>=5.0.0, <=5.0.22)

org.cometd.java:cometd-java-server-common MAVEN version =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.0, =5.0.2, =5.0.22 Source cves: CVE-2025-53114 Source advisory: OSV:GHSA-CQGJ-H8VF-4W59...

org.cometd.java:cometd-java-annotation-server (>=6.0.0, <=6.0.18), org.cometd.java:cometd-java-benchmark-server (>=6.0.0, <=6.0.18) +8 more potentially affected by CVE-2025-53114 via org.cometd.java:cometd-java-server-common (>=6.0.0, <=6.0.18)

org.cometd.java:cometd-java-server-common MAVEN version =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.0, =6.0.18 Source cves: CVE-2025-53114 Source advisory: OSV:GHSA-CQGJ-H8VF-4W59...

org.apache.camel.karaf:camel-cometd (>=4.7.0, <=4.10.7), org.apache.camel.quarkus:camel-quarkus-cometd (>=3.13.0, <=3.25.0) +13 more potentially affected by CVE-2025-53114 via org.cometd.java:cometd-java-server-common (>=8.0.0, <=8.0.8)

org.cometd.java:cometd-java-server-common MAVEN version =8.0.0, =4.7.0, =3.13.0, =3.13.0, =4.7.0, =4.7.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.0, =8.0.8 Source cves: CVE-2025-53114 Source advisory: OSV:GHSA-CQGJ-H8VF-4W59...

org.apache.camel.quarkus:camel-quarkus-cometd (>=3.0.0-m1, <=3.6.0), org.apache.camel.quarkus:camel-quarkus-cometd-deployment (>=3.0.0-m1, <=3.6.0) +13 more potentially affected by CVE-2025-53114 via org.cometd.java:cometd-java-server-common (>=7.0.0, <=7.0.18)

org.cometd.java:cometd-java-server-common MAVEN version =7.0.0, =3.0.0-m1, =3.0.0-m1, =3.0.0-m1, =4.0.0-m1, =4.0.0-m1, =7.0.0, =7.0.0, =7.0.0, =7.0.11, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.0, =7.0.18 Source cves: CVE-2025-53114 Source advisory: OSV:GHSA-CQGJ-H8VF-4W59...