A2aproject vulnerabilities
We track 4 vulnerabilities in A2aproject products across 2 products. 4 are rated high or critical, and none are known to be exploited. The most recent was published on October 20, 2026.
Latest A2aproject vulnerabilities
- 7.3 High severity
a2a-rs: Server-Side Request Forgery
A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file crates/server/src/push_notification_sender.rs of the component Push Notification Handler. Such manipulation of the argument TaskPushNotificati
- 7.5 High severity
a2a-java: Insufficiently Protected Credentials
A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Starting in version 1.3.0.Final and prior to version 1.3.2.Final, the AndroidA2AHttpClient synchronous POST path overrides the disabled-redirect setting in AndroidA2AHttpClient.createCon
- 7.5 High severity
a2a-java: Missing Authorization
A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, the default InMemoryTaskStore configuration performs no authorization on task reads: the no-argument constructor sets authorizationProvider to null, and InMemoryTas
- 7.3 High severity
a2a-java: Improper Neutralization of CRLF Sequences
A weakness has been identified in a2aproject a2a-java 1.2.0. The affected element is the function BasePushNotificationSender.dispatchNotification of the file server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java of the com