a2a-java vulnerabilities

3 known vulnerabilities in a2a-java from A2aproject. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  a2a-java: Insufficiently Protected Credentials

  CVE-2026-111765Oct 20, 2026A2aproject

  A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Starting in version 1.3.0.Final and prior to version 1.3.2.Final, the AndroidA2AHttpClient synchronous POST path overrides the disabled-redirect setting in AndroidA2AHttpClient.createCon

• 7.5 High severity

  a2a-java: Missing Authorization

  CVE-2026-111764Oct 20, 2026A2aproject

  A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, the default InMemoryTaskStore configuration performs no authorization on task reads: the no-argument constructor sets authorizationProvider to null, and InMemoryTas

• 7.3 High severity

  a2a-java: Improper Neutralization of CRLF Sequences

  CVE-2026-90819Sep 14, 2026A2aproject

  A weakness has been identified in a2aproject a2a-java 1.2.0. The affected element is the function BasePushNotificationSender.dispatchNotification of the file server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java of the com