a2aproject a2a-java vulnerabilities

Newest CVEs

• CVE-2026-117507

  a2aproject a2a-java TaskManager.saveTaskEvent race condition

  a2aproject · a2a-java

  Medium5.3
• CVE-2026-117506

  a2aproject a2a-java Push Notification Config Store JpaDatabasePushNotificationConfigStore.java InMemoryPushNotificationConfigStore.setInfo resource consumption

  a2aproject · a2a-java

  Medium5.3
• CVE-2026-117505

  a2aproject a2a-java ChildQueue queue.offer resource consumption

  a2aproject · a2a-java

  Medium5.3
• CVE-2026-116479

  a2aproject a2a-java JSON-RPC Error getMessage information exposure

  a2aproject · a2a-java

  Medium5.3
• CVE-2026-111765

  A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix

  a2aproject · a2a-java

  High7.5
• CVE-2026-111764

  A2A Java SDK has a fail-open default task authorization

  a2aproject · a2a-java

  High7.5
• CVE-2026-111763

  A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect

  a2aproject · a2a-java

  Medium5.7
• CVE-2026-111762

  A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure

  a2aproject · a2a-java

  Medium5.7
• CVE-2026-111761

  A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery

  a2aproject · a2a-java

  Medium5.8
• CVE-2026-90820

  a2aproject a2a-java AuthorizationRequestHandlerDecorator.java AuthorizationRequestHandlerDecorator.onListTasks authorization

  a2aproject · a2a-java

  Medium5.3