A2
Product
a2a-java
11
CVEs
0
On KEV
7.5
Max CVSS
9
New 30D
Severity mix
Critical 0High 3Medium 8Low 0
Watch
Add a2a-java to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-111765 | 7.5 | Oct 20 | A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix Affected: >= 1.3.0.Final, < 1.3.2.Final |
| CVE-2026-111764 | 7.5 | Oct 20 | A2A Java SDK has a fail-open default task authorization Affected: < 1.3.0.Final |
| CVE-2026-90819 | 7.3 | Sep 14 | a2aproject a2a-java Authorization Header Construction BasePushNotificationSender.java BasePushNotificationSender.dispatchNotification response splitting Affected: 1.2.0 |
| CVE-2026-111761 | 5.8 | Oct 20 | A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery Affected: < 1.3.0.Final |
| CVE-2026-111763 | 5.7 | Oct 20 | A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect Affected: < 1.3.0.Final |
| CVE-2026-111762 | 5.7 | Oct 20 | A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure Affected: < 1.3.0.Final |
| CVE-2026-117507 New | 5.4 | Oct 27 | a2aproject a2a-java TaskManager.saveTaskEvent race condition Affected: 1.2.0.Final |
| CVE-2026-117506 New | 4.3 | Oct 27 | a2aproject a2a-java Push Notification Config Store JpaDatabasePushNotificationConfigStore.java InMemoryPushNotificationConfigStore.setInfo resource consumption Affected: 1.2.0.Final |
| CVE-2026-117505 New | 4.3 | Oct 27 | a2aproject a2a-java ChildQueue queue.offer resource consumption Affected: 1.2.0.Final |
| CVE-2026-116479 New | 4.3 | Oct 26 | a2aproject a2a-java JSON-RPC Error getMessage information exposure Affected: 1.2.0.Final |
| CVE-2026-90820 | 4.3 | Sep 14 | a2aproject a2a-java AuthorizationRequestHandlerDecorator.java AuthorizationRequestHandlerDecorator.onListTasks authorization Affected: 1.2.0 |
Showing 11