{"id":"CVE-2026-111761","summary":"A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery","details":"A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, BasePushNotificationSender in server-common sends task data to the URL in TaskPushNotificationConfig without destination validation, scheme restrictions, or bounds on redirects. InMemoryPushNotificationConfigStore.setInfo stores the URL verbatim, and onCreateTaskPushNotificationConfig does not validate the destination. In the default deployment with push notifications enabled, an unauthenticated caller can register a destination through an inline SendMessage configuration or CreateTaskPushNotificationConfig for an existing task, causing task status and artifact updates to send requests from the server's network position to loopback, private, link-local cloud-metadata, IPv6 unique-local, unspecified, or multicast destinations where routing permits. JdkA2AHttpClient and VertxA2AHttpClient follow redirects, allowing a webhook redirect to bypass creation-time destination checks and convert a POST into a GET; hostname-only checks also do not prevent DNS rebinding. Direct POST delivery can push attacker-influenced task data into internal services, whereas a redirected POST-to-GET request drops the body. The sender discards the fetched response and does not expose delivery success or failure, so the demonstrated behavior does not provide response read-back. No credentials or user interaction are required. This issue is fixed in version 1.3.0.Final.","aliases":["GHSA-q78c-5jjq-57g8"],"modified":"2026-10-21T09:36:46.237899131Z","published":"2026-10-20T14:54:46.950Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111761.json","cna_assigner":"GitHub_M","cwe_ids":["CWE-918"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111761.json"},{"type":"FIX","url":"https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b"},{"type":"FIX","url":"https://github.com/a2aproject/a2a-java/pull/1096"},{"type":"WEB","url":"https://github.com/a2aproject/a2a-java/releases/tag/v1.3.0.Final"},{"type":"ADVISORY","url":"https://github.com/a2aproject/a2a-java/security/advisories/GHSA-q78c-5jjq-57g8"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111761"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/a2aproject/a2a-java","events":[{"introduced":"0"},{"fixed":"43bde91e3319f0a92db3ac2104215dcdbbb77679"},{"fixed":"b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StringRangeExpression","range":[{"introduced":"0"},{"fixed":"1.3.0.Final"}]},{"source":"REFERENCES_COMMIT","range":[{"fixed":"b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b"}]},{"source":"REFERENCES_TAG","original_tag":"v1.3.0.Final","range":[{"fixed":"43bde91e3319f0a92db3ac2104215dcdbbb77679"}]}]}}],"versions":["v1.2.0.Final","v1.1.0.Final","v1.0.0.Final","nightly-metrics","v1.0.0.CR1","1.0.0.Beta1","v1.0.0.Alpha4","v1.0.0.Alpha3","v1.0.0.Alpha2","v1.0.0.Alpha1","v0.3.0.Final","v0.3.0.Beta2","v0.3.0.Beta1","v0.3.0.Alpha1","0.2.5","0.2.5.Beta2","0.2.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111761.json","vanir_signatures":[{"digest":{"line_hashes":["244620105572644217416796521043673679897","254267032419478228965642226777106514988","100238973510472504841002459826181751370","122436646926956251253252528949539480022","224432309779779895177499381464762294306","35647441542631293460498100570679863913","180999923213191884622906997831310282828","222454100375300958745381605286419680195","137026380366763478126928223967892120541","68373370882436859564214649608579345916","339425237029073214194386938285423299362","267414783431894123876215098517556372457","302997787562838535920182738704280782384","227691018107438283576405624468554714790","297235634268695338384067102471552979012","297149906141209969725966034346535002349","321527251983318555152337854790666201497","269784841026451011653080152442555297619","108318802981310434692409715933597930348","211354909441449177589369427139747837285","76363815818934138312635345021445082384","317263641072757088809022550476980764108","213239374963121445175148984019519012279","2010825970649546168007569038516565005","145129413269559205601052639470257016450","245806583991983791595303989745811218530","77161316495127344665552050497247087600","56106776760615126619250642233648975488","102665362000851881923273280697863204853","13646141758938974490158614448118132308","239646808357681112109307432231625411813","220426664379138367828023219508396831608","332146767946203113504548945949251724392","306715395854070318247067801060452247027","306678296845878494369341589373536970242","205827101726335568316822816401198463275","32319042150213853024006116774621805901","163166033882030256978895326898877306585","236126550553356617768485914945844621179","47527756131265126820287659998862043171","331215131072525171392978028346263007484","49995286486467312755081339012817632954","307926355357926582254272567263091992666","255798782399849599537757019728965026254","255407997467308771883148889575791531693","239021839033758172013678731706285552990"],"threshold":0.9},"id":"CVE-2026-111761-070aa376","signature_type":"Line","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b","target":{"file":"server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java"},"deprecated":false},{"digest":{"function_hash":"68700418044791783547228816044463494141","length":148},"id":"CVE-2026-111761-09b51ba8","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/tasks/PushNotificationSenderTest.java","function":"setUp"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b","target":{"file":"extras/http-client-vertx/src/main/java/org/a2aproject/sdk/client/http/vertx/VertxA2AHttpClient.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["31544325588870301888166175672986442172","278301685630891122463881086177189507164","197388619177440026844140555232858799765","55331396843212050405403976820998113825","252707378710353366466184430286657607383","74947488658084257839660905039369707469","109993903720252957967771444069732211643","141030993582078015250634971076987287058","6555011541209452114970026561381389406","64503888003085015778447562626261834820","190261145792825828180586591834231627282"]},"id":"CVE-2026-111761-0a82623a","signature_type":"Line"},{"source":"https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b","target":{"file":"server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java","function":"BasePushNotificationSender"},"deprecated":false,"digest":{"function_hash":"160886334612543300790606557196363066160","length":267},"id":"CVE-2026-111761-2ae5a9f7","signature_type":"Function","signature_version":"v1"},{"digest":{"threshold":0.9,"line_hashes":["45777562012496679566622241583193759155","5292712662818365788809134375578616570","279726520075602093190648428461262234595","55331396843212050405403976820998113825","155446071635921272237657427357428078099","106695159439763015848872402348490660470","336706331953015670292242317608691222762","272430893185350181526512553314361884761","126756081517771292008349092552148507422","38661811721448211422322449020988165303"]},"id":"CVE-2026-111761-2cd831fe","signature_type":"Line","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b","target":{"file":"extras/http-client-android/src/main/java/org/a2aproject/sdk/client/http/android/AndroidA2AHttpClient.java"},"deprecated":false},{"digest":{"line_hashes":["270152563006339617380551210451725173765","237629647425122130282974699332125319037","47419039559638004349212286787553351645","124160628773578787898094397006732580559","153709594765461648794830523597379339215","170706311671180393636869448648184292358","206087379447941368027522181519791484847","82220865344866488405477848840906207328","153709594765461648794830523597379339215","241769099810839065569379607961564375757","124490949286080401987582981656557856666","121813607368528839877164658292157251243","265374998546150100197114988163682804211","172966072760508809270719639142339978034"],"threshold":0.9},"id":"CVE-2026-111761-42b31987","signature_type":"Line","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/tasks/PushNotificationSenderTest.java"},"deprecated":false},{"deprecated":false,"digest":{"line_hashes":["165274628048481663890544152588656114373","123483957779212259742873887725168821710","209370696152766427707066428042234728098","81619916438582663445016929422161264012","75765808375875084829729131818982306663","307842672000498076739574047368563414496","99277404533833130416637732528124046162","36071154879961230623472884567497379708","92636030953861229146931428394305765764","306872316622127508953690355380390593912","133201171962155161219233531209478007213","293554939789671915890525220743604126667","245010258203155254956452867094105343355","90181869145346877576821510687080992654","184055591605462981036315793550220090832","336578356502186803615329139170681274701","144010676131597112747166624314569387418","28231595507485570231106523610749190758","50530693290009164840420874823033225552","326183545667111130147530493099893562077","260985670929095321279969327916140864285","143990017622019209579669478754965464122","56173986258392831167920542964614554849","46258426413078669511970478529372510995","235106529867754643537358372769073605087","102021317903642352816118571492631330373","98381929839509404100828760100921645723","278862451920268984969947871438198414669","28231595507485570231106523610749190758","50530693290009164840420874823033225552","326183545667111130147530493099893562077"],"threshold":0.9},"id":"CVE-2026-111761-43f934ec","signature_type":"Line","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b","target":{"file":"extras/push-notification-config-store-database-jpa/src/test/java/org/a2aproject/sdk/extras/pushnotificationconfigstore/database/jpa/JpaPushNotificationConfigStoreTest.java"}},{"source":"https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandlerTest.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["236551226987071516529032878816758635625","298091824596797426018062496412315110951","289098900547231551160397536180209554903","186827325583017179155703005676224197025","13996129198836813820229641966089389018","206613714787137512943838075933272613948","86592454960793038776117514554902841337","111778023965639062848900596886964949329","28291407662031267643085604950240322770","90795073403637242329493072077890645688"]},"id":"CVE-2026-111761-46b55c28","signature_type":"Line","signature_version":"v1"},{"target":{"file":"server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandler.java","function":"build"},"deprecated":false,"digest":{"length":932,"function_hash":"254712268611160099921505775961149141382"},"id":"CVE-2026-111761-5551b475","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b"},{"deprecated":false,"digest":{"length":213,"function_hash":"267409823853126610248209559840394404859"},"id":"CVE-2026-111761-586207cf","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b","target":{"file":"extras/http-client-vertx/src/main/java/org/a2aproject/sdk/client/http/vertx/VertxA2AHttpClient.java","function":"post"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b","target":{"function":"setUp","file":"server-common/src/test/java/org/a2aproject/sdk/server/tasks/InMemoryPushNotificationConfigStoreTest.java"},"deprecated":false,"digest":{"function_hash":"297457625669281986449209899115145248232","length":165},"id":"CVE-2026-111761-5fca957d"},{"digest":{"length":1246,"function_hash":"36531493374730262799396220962431939848"},"id":"CVE-2026-111761-6a53aeee","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b","target":{"file":"extras/push-notification-config-store-database-jpa/src/test/java/org/a2aproject/sdk/extras/pushnotificationconfigstore/database/jpa/JpaPushNotificationConfigStoreTest.java","function":"testSendNotificationWithToken"},"deprecated":false},{"digest":{"function_hash":"60448450930407039982650232984398057176","length":316},"id":"CVE-2026-111761-7593c711","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b","target":{"file":"extras/http-client-android/src/main/java/org/a2aproject/sdk/client/http/android/AndroidA2AHttpClient.java","function":"post"},"deprecated":false},{"digest":{"function_hash":"319736472157514223509442076090460896308","length":1420},"id":"CVE-2026-111761-82bbc686","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/tasks/InMemoryPushNotificationConfigStoreTest.java","function":"testSendNotificationWithToken"},"deprecated":false},{"id":"CVE-2026-111761-83feae64","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/tasks/InMemoryPushNotificationConfigStoreTest.java","function":"setupBasicMockHttpResponse"},"deprecated":false,"digest":{"function_hash":"274332622591957583720326966841804246797","length":577}},{"signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b","target":{"file":"server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandler.java","function":"onCreateTaskPushNotificationConfig"},"deprecated":false,"digest":{"function_hash":"105548166151080734170274148252853340614","length":545},"id":"CVE-2026-111761-8764dbad","signature_type":"Function"},{"digest":{"function_hash":"75675301753110435362949730830533671491","length":121},"id":"CVE-2026-111761-897b8049","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b","target":{"file":"server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java","function":"BasePushNotificationSender"},"deprecated":false},{"digest":{"length":2002,"function_hash":"93980708127990097776155987365789219416"},"id":"CVE-2026-111761-89c763a4","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b","target":{"function":"dispatchNotification","file":"server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/tasks/InMemoryPushNotificationConfigStoreTest.java"},"deprecated":false,"digest":{"line_hashes":["206980361190793289814124548523772244059","77819840931014612384530682078410766524","19569124643187349643645141566932204775","101085579785743831293091310647171663213","99336499304419461297465730489893956667","187536894249117192303154975112161018422","184055591605462981036315793550220090832","154254517072861040703465773111627508802","49634455247513331290891086846287270045","135436512141767726060995137463350971306","180347706140002232789343744961356920949","186004037116230244666633270444693386911","135989349229494870284583413313449607760","31301705418372574007491205727162503783","50530693290009164840420874823033225552","326183545667111130147530493099893562077"],"threshold":0.9},"id":"CVE-2026-111761-940f653b"},{"source":"https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b","target":{"file":"server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandler.java","function":"initConfig"},"deprecated":false,"digest":{"function_hash":"85454586256366233082583368603818545853","length":885},"id":"CVE-2026-111761-99268b7f","signature_type":"Function","signature_version":"v1"},{"target":{"function":"init","file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandlerTest.java"},"deprecated":false,"digest":{"function_hash":"281628569271179130725590585908274430543","length":1036},"id":"CVE-2026-111761-a4dd0086","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b"},{"digest":{"function_hash":"262356045621550411692769833341949477200","length":1143},"id":"CVE-2026-111761-ac576240","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b","target":{"function":"init","file":"compat-0.3/server-conversion/src/test/java/org/a2aproject/sdk/compat03/conversion/AbstractA2ARequestHandlerTest_v0_3.java"},"deprecated":false},{"digest":{"function_hash":"85311135866410959327574530966420341957","length":239},"id":"CVE-2026-111761-ad165f0c","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b","target":{"file":"server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java","function":"BasePushNotificationSender"},"deprecated":false},{"target":{"file":"extras/push-notification-config-store-database-jpa/src/test/java/org/a2aproject/sdk/extras/pushnotificationconfigstore/database/jpa/JpaPushNotificationConfigStoreTest.java","function":"setUp"},"deprecated":false,"digest":{"function_hash":"137521440703589846159760941002028721051","length":132},"id":"CVE-2026-111761-aea33623","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b"},{"target":{"function":"testSendNotificationSkipsWhenFormatterReturnsNull","file":"server-common/src/test/java/org/a2aproject/sdk/server/tasks/PushNotificationSenderTest.java"},"deprecated":false,"digest":{"length":726,"function_hash":"167500594880541970988741630757293552424"},"id":"CVE-2026-111761-af9e8dd4","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b"},{"signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AbstractA2ARequestHandlerTest.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["302174196612865062789232168130295147053","157757082064378641740192695741142874002","191637633944832106192750158258735129255","302940694993425246047158017173866079892","325769033342142666006670283579987110318","138370006435254220824707408127321280303","334483587269079601565956026588120349234","195184916912165073403206263175767567505","13996129198836813820229641966089389018","206613714787137512943838075933272613948","86592454960793038776117514554902841337","111778023965639062848900596886964949329"]},"id":"CVE-2026-111761-b0a967a7","signature_type":"Line"},{"target":{"file":"server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java","function":"BasePushNotificationSender"},"deprecated":false,"digest":{"function_hash":"329016171195576255136421666196389057456","length":159},"id":"CVE-2026-111761-b1f9ba44","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b"},{"signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b","target":{"file":"compat-0.3/server-conversion/src/test/java/org/a2aproject/sdk/compat03/conversion/AbstractA2ARequestHandlerTest_v0_3.java"},"deprecated":false,"digest":{"line_hashes":["302174196612865062789232168130295147053","157757082064378641740192695741142874002","191637633944832106192750158258735129255","49311856289561375785956981022981911252","325769033342142666006670283579987110318","138370006435254220824707408127321280303","334483587269079601565956026588120349234","195184916912165073403206263175767567505","252297831880423685057018770328017825403","206613714787137512943838075933272613948","86592454960793038776117514554902841337","111778023965639062848900596886964949329"],"threshold":0.9},"id":"CVE-2026-111761-b53570a6","signature_type":"Line"},{"deprecated":false,"digest":{"function_hash":"48988855597519257059807119747340245752","length":1102},"id":"CVE-2026-111761-be7a3303","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AbstractA2ARequestHandlerTest.java","function":"init"}},{"id":"CVE-2026-111761-be92aa93","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b","target":{"function":"initMessageSend","file":"server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandler.java"},"deprecated":false,"digest":{"function_hash":"53504664424411017795762305237640890692","length":1379}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b","target":{"function":"shouldAddPushInfo","file":"server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandler.java"},"deprecated":false,"digest":{"function_hash":"174029187015159285018676459265519189436","length":146},"id":"CVE-2026-111761-c4352afa"},{"deprecated":false,"digest":{"line_hashes":["1387041056332918291602422789151332202","121800772706568564777791315409851999059","155855451047595949039389560627846282750","65392479243097883018630640916177264726","289386314864538027116540745190615428254","197374022937042301837162162025386244690","22007423316190502663955256112115414491","191566521422232287249470273381670202628","101780729728574165480364773834986441024","20027287559778260854185583877654971876","32209077291502206697096978583158692946","78376015646387082915557273748747100413","204341884406114106303620228503863985722","132817665785334391653509144650851549302","45586886500904142638823888799729775161","160646960213597272669531013225821375134","235200272295225978923875048883193135527","98133035953037259965147628431980408558","312468354715073134048971143763682463214","254234629380279155361096310099102120453","29766851877156580548113167023669163540","330706960072618265321290819952598816204","250880031742557731368281785714864651910","180336505752041458103346156091706570738","123961862717393636583367384916543753045","245408195432820852972536279614222423013","47716443737610122978860928727133023862","323680803914468716125714871574879602938","313681144769741020724276768479384283063","210671107872145903664149722080737509592","310809341998682119444757010413710134164","289470805404706035019322425669459606323","172044497642736905281059601610263107366","115769557904867045046923162365971569256","136383805946817752216163671646542585908","339607669884642610041625554342407170800","3171825967874334871817527097026105626"],"threshold":0.9},"id":"CVE-2026-111761-cce046ba","signature_type":"Line","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b","target":{"file":"server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandler.java"}},{"signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b","target":{"function":"BasePushNotificationSender","file":"server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java"},"deprecated":false,"digest":{"length":138,"function_hash":"66823060567504727969961209272079017347"},"id":"CVE-2026-111761-d394bcec","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["149827066191110844136000625392035459384","173363871580941101671373033517122027903","42141396146126543827556691186213499146"],"threshold":0.9},"id":"CVE-2026-111761-d56b6f49","signature_type":"Line","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b","target":{"file":"http-client/src/main/java/org/a2aproject/sdk/client/http/A2AHttpClient.java"}},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b","target":{"file":"http-client/src/main/java/org/a2aproject/sdk/client/http/JdkA2AHttpClient.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["175726866628377098870546532950496783500","215628170622124715715535161201649625978","264686129463801275352613387392394137926","70114030276107021255825670662108585158","333395636775360347258584806378620897195","71031171397334140720747866058825647797","170744532942455200678886765886949221273","99274279473754017690435387994074637995","195097291466220749168710234782868304794","189140509629241724672665665676870892876","9033146801021013062242787874285452898","60874965552211431154335231734033953333","107326199521294085305811904760663866685","106546462493792903086494602830410822916","81745163744666750604676685751176101681","239127203116889655279710609354403634736","7152986475998757803119044120633725507","85293911247829598791254393205453683661","157802332603953034273237800488557452600","168143265968857094461132188963451750101","79220618232715319831460138688307177992"]},"id":"CVE-2026-111761-db5fdbca"},{"target":{"file":"http-client/src/test/java/org/a2aproject/sdk/client/http/JdkA2AHttpClientTest.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["327058435350615729751790206677169620814","96470080507136311324271689966675395971","127039563436862479157483101471982661166"]},"id":"CVE-2026-111761-f8756c1a","signature_type":"Line","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b"},{"target":{"file":"extras/push-notification-config-store-database-jpa/src/test/java/org/a2aproject/sdk/extras/pushnotificationconfigstore/database/jpa/JpaPushNotificationConfigStoreTest.java","function":"testSendNotificationSuccess"},"deprecated":false,"digest":{"function_hash":"41130411448596330981340946036453641908","length":1420},"id":"CVE-2026-111761-fbed1055","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b","target":{"function":"testSendNotificationUsesFormatterForVersionedConfig","file":"server-common/src/test/java/org/a2aproject/sdk/server/tasks/PushNotificationSenderTest.java"},"deprecated":false,"digest":{"function_hash":"216859951416356590918422961764765110829","length":1011},"id":"CVE-2026-111761-fd789826"}],"vanir_signatures_modified":"2026-10-21T09:36:46Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N"}]}