org.a2aproject.sdk:a2a-java-sdk-server-common
Maven2 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting org.a2aproject.sdk:a2a-java-sdk-server-commonpage 1 of 1
- CVE-2026-111761MEDIUMCVSS 5.8EG 5.8fixed in 1.3.0.Final2026-10-20
vulnerable: 1.0.0.Alpha4 ... 1.2.0.Final (6 versions)
A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, BasePushNotificationSender in server-common sends task data to the URL in TaskPushNotificationConfig without destination validation, scheme res…
- CVE-2026-111764HIGHCVSS 7.5EG 7.5fixed in 1.3.0.Final2026-10-20
vulnerable: 1.0.0.Alpha4 ... 1.2.0.Final (6 versions)
A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, the default InMemoryTaskStore configuration performs no authorization on task reads: the no-argument constructor sets authorizationProvider to …
Check whether org.a2aproject.sdk:a2a-java-sdk-server-common is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for org.a2aproject.sdk:a2a-java-sdk-server-common CVEs against the assets you own.
Book a Demo →