What’s Vulnerable › Products

a2aproject a2a-java vulnerabilities

8 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.

Check whether your a2aproject a2a-java version is affected

Latest a2aproject a2a-java vulnerabilities

• CVE-2026-116479 — a2aproject a2a-java JSON-RPC Error getMessage information exposure (CVSS 4.3)
• CVE-2026-111765 — A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix (CVSS 7.5)
• CVE-2026-111764 — A2A Java SDK has a fail-open default task authorization (CVSS 7.5)
• CVE-2026-111763 — A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect (CVSS 5.7)
• CVE-2026-111762 — A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure (CVSS 5.7)
• CVE-2026-111761 — A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery (CVSS 5.8)
• CVE-2026-90820 — a2aproject a2a-java AuthorizationRequestHandlerDecorator.java AuthorizationRequestHandlerDecorator.onListTasks authorization (CVSS 4.3)
• CVE-2026-90819 — a2aproject a2a-java Authorization Header Construction BasePushNotificationSender.java BasePushNotificationSender.dispatchNotification response splitting (CVSS 7.3)