A2aproject A2a-java vulnerabilities

• a2aproject a2a-java a2aproject a2a-java TaskManager.saveTaskEvent race condition CVE-2026-117507 5.3 MediumOctober 27, 2026
• a2aproject a2a-java a2aproject a2a-java Push Notification Config Store JpaDatabasePushNotificationConfigStore.java InMemoryPushNotificationConfigStore.setInfo resource consumption CVE-2026-117506 5.3 MediumOctober 27, 2026
• a2aproject a2a-java a2aproject a2a-java ChildQueue queue.offer resource consumption CVE-2026-117505 5.3 MediumOctober 27, 2026
• a2aproject a2a-java a2aproject a2a-java JSON-RPC Error getMessage information exposure CVE-2026-116479 5.3 MediumOctober 26, 2026
• a2aproject a2a-java A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix CVE-2026-111765 Fix available 7.5 HighOctober 20, 2026
• a2aproject a2a-java A2A Java SDK has a fail-open default task authorization CVE-2026-111764 Fix available 7.5 HighOctober 20, 2026
• a2aproject a2a-java A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect CVE-2026-111763 Fix available 5.7 MediumOctober 20, 2026
• a2aproject a2a-java A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure CVE-2026-111762 Fix available 5.7 MediumOctober 20, 2026
• a2aproject a2a-java A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery CVE-2026-111761 Fix available 5.8 MediumOctober 20, 2026
• a2aproject a2a-java a2aproject a2a-java AuthorizationRequestHandlerDecorator.java AuthorizationRequestHandlerDecorator.onListTasks authorization CVE-2026-90820 5.3 MediumSeptember 14, 2026
• a2aproject a2a-java a2aproject a2a-java Authorization Header Construction BasePushNotificationSender.java BasePushNotificationSender.dispatchNotification response splitting CVE-2026-90819 6.9 MediumSeptember 14, 2026