{"id":"CVE-2026-111764","summary":"A2A Java SDK has a fail-open default task authorization","details":"A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, the default InMemoryTaskStore configuration performs no authorization on task reads: the no-argument constructor sets authorizationProvider to null, and InMemoryTaskStore.get(String taskId) returns the stored task without checking the caller or owner. Authorization depends on supplying a TaskAuthorizationProvider and routing requests through AuthorizationRequestHandlerDecorator, whether installed through CDI or explicitly by the application. Default store wiring and manually constructed DefaultRequestHandler.builder().build() handlers, including integrations such as Spring, leave task reads unprotected when no effective authorization-provider and decorator check is installed. In a multi-caller deployment using the default configuration, a caller who knows or guesses another caller's task ID can retrieve the task status, context ID, message history, and artifacts. The default/reference transport endpoints do not enforce authentication, so the task-read disclosure is reachable by an unauthenticated caller rather than requiring a privileged account. This issue is fixed in version 1.3.0.Final.","aliases":["GHSA-qw47-mcm5-934w"],"modified":"2026-10-21T09:36:46.622161870Z","published":"2026-10-20T15:05:26.905Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-1188","CWE-862"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111764.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111764.json"},{"type":"FIX","url":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553"},{"type":"FIX","url":"https://github.com/a2aproject/a2a-java/pull/1095"},{"type":"WEB","url":"https://github.com/a2aproject/a2a-java/releases/tag/v1.3.0.Final"},{"type":"ADVISORY","url":"https://github.com/a2aproject/a2a-java/security/advisories/GHSA-qw47-mcm5-934w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111764"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/a2aproject/a2a-java","events":[{"introduced":"0"},{"fixed":"43bde91e3319f0a92db3ac2104215dcdbbb77679"},{"fixed":"efb4e985e99390c4fc1f78c0a187a4254c0a2553"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StringRangeExpression","range":[{"introduced":"0"},{"fixed":"1.3.0.Final"}]},{"source":"REFERENCES_COMMIT","range":[{"fixed":"efb4e985e99390c4fc1f78c0a187a4254c0a2553"}]},{"original_tag":"v1.3.0.Final","range":[{"fixed":"43bde91e3319f0a92db3ac2104215dcdbbb77679"}],"source":"REFERENCES_TAG"}]}}],"versions":["v1.2.0.Final","v1.1.0.Final","v1.0.0.Final","nightly-metrics","v1.0.0.CR1","1.0.0.Beta1","v1.0.0.Alpha4","v1.0.0.Alpha3","v1.0.0.Alpha2","v1.0.0.Alpha1","v0.3.0.Final","v0.3.0.Beta2","v0.3.0.Beta1","v0.3.0.Alpha1","0.2.5","0.2.5.Beta2","0.2.3"],"database_specific":{"vanir_signatures_modified":"2026-10-21T09:36:46Z","source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111764.json","vanir_signatures":[{"digest":{"function_hash":"285693028531848587005692567093995901872","length":717},"id":"CVE-2026-111764-02b4eefe","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"function":"testOnGetPushNotificationNoPushNotifierConfig","file":"transport/jsonrpc/src/test/java/org/a2aproject/sdk/transport/jsonrpc/handler/JSONRPCHandlerTest.java"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java","function":"setUp"},"deprecated":false,"digest":{"function_hash":"295112548762344037205684050472038867249","length":86},"id":"CVE-2026-111764-04a6726d"},{"source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandlerReferenceTaskAuthorizationTest.java","function":"nullTaskId_skipsAuthorizationCheck"},"deprecated":false,"digest":{"function_hash":"154110591467771215821298590905595886031","length":137},"id":"CVE-2026-111764-071c609d","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandler.java","function":"onDeleteTaskPushNotificationConfig"},"deprecated":false,"digest":{"function_hash":"228114185604918191936866316574080881168","length":293},"id":"CVE-2026-111764-07908d14","signature_type":"Function"},{"target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandlerTest.java"},"deprecated":false,"digest":{"line_hashes":["111778023965639062848900596886964949329","126010394243428478581590943868493758640","161682440659051478667279994203891259253","9043863290661722052388714258054026568","82732963541973358944114500977125936510","130933186291235563290983547304063659491","261771354232614418425492521858326430872","244179453235699034589827814889864001227"],"threshold":0.9},"id":"CVE-2026-111764-0911cc63","signature_type":"Line","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553"},{"digest":{"length":431,"function_hash":"39638912097206098207597065137710620358"},"id":"CVE-2026-111764-0c3d6017","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java","function":"onCreateTaskPushNotificationConfig_denied"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"82396674588425263098318568798080975859","length":69},"id":"CVE-2026-111764-0e0d7f85","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java","function":"setUp"}},{"id":"CVE-2026-111764-0f39eae2","signature_type":"Line","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"compat-0.3/server-conversion/src/test/java/org/a2aproject/sdk/compat03/conversion/AbstractA2ARequestHandlerTest_v0_3.java"},"deprecated":false,"digest":{"line_hashes":["111778023965639062848900596886964949329","126010394243428478581590943868493758640","155247045046437277212353022012146827317","305565900897901080717149132727825958084"],"threshold":0.9}},{"id":"CVE-2026-111764-152f275f","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java","function":"onMessageSend_returnsMessage_noOwnershipRecording"},"deprecated":false,"digest":{"length":678,"function_hash":"47144438115386259795484953526633303412"}},{"id":"CVE-2026-111764-1dc0b0da","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"function":"onNext","file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java"},"deprecated":false,"digest":{"length":66,"function_hash":"326189542999554120036052200440463795276"}},{"source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandler.java","function":"build"},"deprecated":false,"digest":{"function_hash":"203691290638916526701958942756306038930","length":878},"id":"CVE-2026-111764-1f4d6283","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"function":"testDeletePushNotificationConfigNoPushConfigStore","file":"transport/jsonrpc/src/test/java/org/a2aproject/sdk/transport/jsonrpc/handler/JSONRPCHandlerTest.java"},"deprecated":false,"digest":{"function_hash":"256517085171756763084896984443522858674","length":1068},"id":"CVE-2026-111764-21a57718","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"transport/grpc/src/test/java/org/a2aproject/sdk/transport/grpc/handler/GrpcHandlerTest.java","function":"testOnGetPushNotificationNoPushNotifierConfig"},"deprecated":false,"digest":{"length":587,"function_hash":"232465855232223667101245226499058560967"},"id":"CVE-2026-111764-2323f338"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java","function":"onMessageSendStream_newTask_recordsOwnershipOnFirstTaskEvent"},"deprecated":false,"digest":{"length":1432,"function_hash":"2083571121491578606638591570779765487"},"id":"CVE-2026-111764-2de2657b"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java","function":"onListTasks"},"deprecated":false,"digest":{"function_hash":"163135939505130862244845532032428427930","length":132},"id":"CVE-2026-111764-31ad3f0e"},{"deprecated":false,"digest":{"function_hash":"121500022159485159092922342958710457720","length":102},"id":"CVE-2026-111764-31e891eb","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java","function":"request"}},{"source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"transport/jsonrpc/src/test/java/org/a2aproject/sdk/transport/jsonrpc/handler/JSONRPCHandlerTest.java","function":"testOnSetPushNotificationNoPushNotifierConfig"},"deprecated":false,"digest":{"function_hash":"182032279263544039612495195166233042119","length":838},"id":"CVE-2026-111764-33177160","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"244617793292112661852531616936509496937","length":203},"id":"CVE-2026-111764-3677775b","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"function":"onDeleteTaskPushNotificationConfig","file":"server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java","function":"onNext"},"deprecated":false,"digest":{"function_hash":"43279170985129789382776379516818480128","length":470},"id":"CVE-2026-111764-3828ef31","signature_type":"Function"},{"digest":{"function_hash":"4000261108362279448506005667375869456","length":825},"id":"CVE-2026-111764-38f83a0c","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"transport/grpc/src/test/java/org/a2aproject/sdk/transport/grpc/handler/GrpcHandlerTest.java","function":"testListPushNotificationConfigNoPushConfigStore"},"deprecated":false},{"digest":{"function_hash":"208123780512230640776629664411051444592","length":490},"id":"CVE-2026-111764-3a5c087f","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java","function":"onMessageSend_existingTask_denied"},"deprecated":false},{"target":{"file":"server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java","function":"enforceListRead"},"deprecated":false,"digest":{"function_hash":"102144624635585422532211560063482132734","length":215},"id":"CVE-2026-111764-3b3daf16","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553"},{"digest":{"function_hash":"109187266290794778467591270667257373065","length":1327},"id":"CVE-2026-111764-3bc92a57","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"function":"onMessageSendStream_messageOnly_noOwnershipRecording","file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java"},"deprecated":false},{"digest":{"function_hash":"184737205227788149739553744493513841176","length":336},"id":"CVE-2026-111764-3d60323f","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java","function":"onDeleteTaskPushNotificationConfig_denied"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"40762169067706210875392646913419648952","length":278},"id":"CVE-2026-111764-442afe83","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandler.java","function":"onListTaskPushNotificationConfigs"}},{"source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java","function":"testTask"},"deprecated":false,"digest":{"length":278,"function_hash":"317608140284980890642960403777340713126"},"id":"CVE-2026-111764-4606bd54","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"277491264820271387286391522625520757352","length":1122},"id":"CVE-2026-111764-4b6f6616","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"compat-0.3/server-conversion/src/test/java/org/a2aproject/sdk/compat03/conversion/AbstractA2ARequestHandlerTest_v0_3.java","function":"init"}},{"deprecated":false,"digest":{"function_hash":"199867628089020089085189516705454190336","length":209},"id":"CVE-2026-111764-564378cc","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java","function":"onListTaskPushNotificationConfigs"}},{"id":"CVE-2026-111764-5910af2f","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java","function":"enforceWrite"},"deprecated":false,"digest":{"function_hash":"271355244793999333974315373556626435163","length":208}},{"deprecated":false,"digest":{"function_hash":"206202196633281912219370257068998153136","length":1015},"id":"CVE-2026-111764-5b6f38d7","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandlerTest.java","function":"init"}},{"deprecated":false,"digest":{"length":102,"function_hash":"98045694500391460090021174867189380402"},"id":"CVE-2026-111764-5c64ca44","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java","function":"init"}},{"source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"compat-0.3/transport/jsonrpc/src/test/java/org/a2aproject/sdk/compat03/transport/jsonrpc/handler/JSONRPCHandler_v0_3_Test.java","function":"testDeletePushNotificationConfigNoPushConfigStore"},"deprecated":false,"digest":{"function_hash":"300397387158550987129409696804908109810","length":1162},"id":"CVE-2026-111764-5cdd4a35","signature_type":"Function","signature_version":"v1"},{"digest":{"function_hash":"118618980946591091860480478257896691757","length":60},"id":"CVE-2026-111764-5ebf90d0","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java","function":"onSubscribe"},"deprecated":false},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandler.java","function":"initConfig"},"deprecated":false,"digest":{"length":772,"function_hash":"295373700472228121852403474465773281797"},"id":"CVE-2026-111764-5f7a1b4a"},{"source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"function":"testOnSetPushNotificationNoPushNotifierConfig","file":"compat-0.3/transport/jsonrpc/src/test/java/org/a2aproject/sdk/compat03/transport/jsonrpc/handler/JSONRPCHandler_v0_3_Test.java"},"deprecated":false,"digest":{"function_hash":"200646463741947110494788206407291603753","length":889},"id":"CVE-2026-111764-5fee14e8","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java","function":"authorizeTaskAccess"},"deprecated":false,"digest":{"function_hash":"210355511606572239134639561559782658702","length":199},"id":"CVE-2026-111764-623b32a9","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java","function":"onGetTask_denied"},"deprecated":false,"digest":{"function_hash":"146261132853462999046910539545002863155","length":309},"id":"CVE-2026-111764-6547e7a5"},{"source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandler.java","function":"onCancelTask"},"deprecated":false,"digest":{"function_hash":"115356838543541701676318697339909172895","length":284},"id":"CVE-2026-111764-65b188ba","signature_type":"Function","signature_version":"v1"},{"target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandlerReferenceTaskAuthorizationTest.java"},"deprecated":false,"digest":{"line_hashes":["300830275633453035223164091612992146142","227500042401767958867223137058047227447","218236314445356600269777127323874032000","237384421196322437557210229836792020058","221059294307933936084358904054274479979","239216346660205586715477959762632129279","107591876415196999894163909742473371062","100715074675029368923461520156325092721","265836720085693923356895034292652629750","134564245773458751072568510139545491037","265302591661457635098807100878476731731","201889463868182825827397389609784927613","116075626922247006163563702472395142180","134137802887801608613157120764419374822","94774301941556102994344948032979863379","317923707042491134204285320410195408685","53267912824027025672503418945319362787","283701008509459079237151615551560328756","87277363032206602094764482476882730774","155738837399868613793835331885062012844","58959165960099362445183865737860609321","6475660302364584081228307847259283136","215926006004950488918027142257432697861","235978272505085489169446644254270456339","120810620653783443135683842328971130007"],"threshold":0.9},"id":"CVE-2026-111764-6a476644","signature_type":"Line","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553"},{"deprecated":false,"digest":{"function_hash":"118618980946591091860480478257896691757","length":60},"id":"CVE-2026-111764-6bad1681","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"function":"onSubscribe","file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java"}},{"deprecated":false,"digest":{"function_hash":"273775917064472954589366759189977912030","length":756},"id":"CVE-2026-111764-6c62394e","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java","function":"onMessageSend_existingTask_allowed_recordsOwnershipIfNeeded"}},{"target":{"function":"enforceRead","file":"server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java"},"deprecated":false,"digest":{"length":208,"function_hash":"271355244793999333974315373556626435163"},"id":"CVE-2026-111764-702ba85a","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553"},{"digest":{"length":562,"function_hash":"105862969906421985112179595695767212276"},"id":"CVE-2026-111764-70b6c735","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java","function":"onMessageSend_newTask_createsTask_recordsOwnership"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"30525602181776342616085190782745198408","length":185},"id":"CVE-2026-111764-72154f89","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandlerReferenceTaskAuthorizationTest.java","function":"ownerCanValidateOwnActiveTask"}},{"digest":{"function_hash":"88864180209136355152669737512024448647","length":339},"id":"CVE-2026-111764-748a0149","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java","function":"onListTasks_delegatesWithoutChecks"},"deprecated":false},{"target":{"function":"setUp","file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java"},"deprecated":false,"digest":{"length":86,"function_hash":"295112548762344037205684050472038867249"},"id":"CVE-2026-111764-766ffe5a","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553"},{"source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java","function":"onSubscribeToTask"},"deprecated":false,"digest":{"function_hash":"160088145120967179902291563608686484601","length":191},"id":"CVE-2026-111764-76fb110c","signature_type":"Function","signature_version":"v1"},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java"},"deprecated":false,"digest":{"line_hashes":["253678016618954122971322840571429936657","76738824961157084985615220847696783930","281629979146234503073053832675395468193","113254696215345723026982664678784956097","89368892506915845474529812422868870467","142958729827478120173853194057325603716","45907288363292190947519767303737792385","58267305725858522583541596415204910056","294096781746170627757133274383902972344","28862579680672022046152587276600331154","144335755874353716676358917519571566167","74534578455696761981361658469884356209","174531285607834070935573490580745467599","86493447288996178124983854277110515097","149076521523770829274660366290090849101","115169008776908005803693422018001681792","210969532623685863478168399958005260879","309061689243852132061102597115968628978","53368816913996705677594699343040003720","140544179526617541082207204443917399829","138254227162892273362791181045176920947","103292745284941649334843206532294393947","28572831104662890643649653274118436729","32568666914228599150771832073697193720","281318996475693492322858856026041690064","280542075500440235210257907936189520901","281579172994400488933685891209243185273","253360289737244292774927774859422864690","167347944272259052868001740467317398250","35922224230033875001961126093187436364","335603100078381088969046483157270095428","115934399690897306279083562817156553545","230986947174787568676511523470521222843","118527998098041751972149865811119076018","220138988179861829200032023497813029512","129441905901296520910519423912460906425","71610116587560082346455530550777127079","221986598799817978321526888251364313864","266312529744065787241276053337411286493","146357111671361486636941928665487591527","36967134721822888093314495098298002695","66239506392448446163199643802105469803","7784971953925114166535543609875150914","89142229221261318217315400692225509941","269504857759313817817006123482285540525","93566340398148660246244233818173882352","222623170673042806333859294535481680240","220579037321019819847433323499879743003","96569017927119155985917364123354853428","12077343128016188221505201335021473995","17874117843945282076901088794130879061","53815771563065287083528280097283950835","25795950609340699043749528203750438017","22452068729414625872431445704053308872","264391702473210744373835205566735177805","67319028342476331371836696396705947560","133137000248276652550133908628145491526","333526684137942039834881865831131271678","7278790929139474940970674716626131549","24889900390562809449738357440075664371","151275323965666630147994101081027619376","39362893866592204877267923914067883405","97878742917900239189874678120972465275","188628993063473740540284226722998056237","86509855906841907459879212939001931680","115190436806796306890075585173560627144","165181792841392315626465713908918316064","228800607729836071830082299031969506776","39677422781687119978070170390051536345","167279560195729704013547830913769769829","152454236742156975876165930906887209918","147043580899939894210050976218991638128","156595608358211742869950782408239694489","282567736122237524684369820792845587537","325191933176160686471375935306796309603","74910010094093160704907041058419372261","204222555071524359988401006658484608266","179732820271421051909442796014905293561","170163286510553036032853403852820145584","243433951627688500773492644100989282262","264328182842778423615753408733401330140","299910038628017455852546851398564504037","209148742379144853545111389719042942482","91312379097151058799358867666085243007","325373672020478642739894354778648717009","280276719164323978721389114842605507001","201187983270273966588306357464238339428","155358087280201890755808239979430078113","142569713024744296222896113757808620848","45769859023116560246005750556883785941","41638369315346205627464792600412094781","53839136140848764103007640374022397067","183650420722527210105806958022739741488","145267068143567589767624413707590659112","118814526325699277037903928131545628082","153066957943857855042731778558188069397","177905307048228908424995445890109760003","10783366070949384682735503250664022287","336877467891155623382572621927389909342","195705592079757760804692408546767101699","55822518294533911166647247799076015349","176044550798479187483687945981688014658","111099947349879150032951780263292810798","136994155686878917974856609711302551254","244954469475971343864012036409301122481","51207354447808069804001791055823726687","130677191477203567375007460082224334385","268263477722328425895950802552811535653","262459517294838060072425938240213849769","70681439278969723790391472474293057606","205408569841379230255524776734858979255","201013755122093576327675826436844929385","131214262543615759194778336865467888853","91348809756182015872697973761524950937","282078867236635453322411782331237206534","274490199099757251150003825945274479196","335884569034712398401233074925721870043","305103039348053372532418346531183806330","105181677386689232496842686298523345559","83066402548963908762727381571951711650","311295439829359551614017582555911775868","93669085962426844124414395051070853429","330076447642543249720713220789036169459","14773022933206796675671657868402819361","101867301085357441336998045574235047711","332027727111707698853605728409740173934","177054753966283763582763405433265736574","64681122683976770164434298398679693092","17533679626857229155244953552600151712","87963404321823092167912578329118690932","4813103574712250723249570121199578817","4642366036605901035065644860180580513","250383803956434854256215935856310004913","108743864750214756620873107796304637869","279585445613107105484519869162374410183","72743760623065867348261685021667217261","89540863803868072380221109729977929887","330640610957943882126555716026650511712","270156302767645291752856565328207068764","242076858025344806864188221789434022409","294885711225527806725323197329962386623","42792045884499019593544938037772426021","147294971906766487376664989202520906754","217713318319282869050190070322609127694","92526711598887728908148016501110720339","304181744577130535560323045835163251912","144701284140629942164128082304888000176","100293094495959895489122510652820472508","323544394158588100800756220723220958865","115132224324331350777719469882326666409","84619138711755417077987246243409828790","218069418090522565017626249174529096402","159886483151527445215270347797754781525","146748672655988864639965693614698447471","253954999541666936855604003365334635216","261199747214825259508305400158040306095","139821487897065238654089355341415311329","324798994292602267824579393237863459284","203151959899469583378527723644644027062","98205717432747836246369041970557890147","229716006334052101740913302067501872193","104721312102771758800812514113325340378","224609416049129116126967864776620822349","12943243519832185405786868127253439617","73585950145880198814493798268407204702","137865445235751633236171552917674387693","271574794913400679605466070055798313688","308172812689027456980535683553208878660","295162273045802166382414073596636406615","309213940758875951976295699379318832509","198401531983207721830311213498209611229","121924924648873759602127669013487960518","66846566605896123827410862686401594146","47414376201875727978874464376251910621","68953917600968531414522547256530449785","239827318150531256448313983681379936855","306535313124210758917517972247837391562","214553368144704424741001476866676465985","39878425058734573199165270597536821782","138428611929046711521053120307958417946","211844674833530448952496592712114240138","255752536632193457826002209336393524968","279266818088756082118054036186637312374","240723449606108222057614840487779895638","170321865176901310768386286383224951962","287217466539457265007485677400923452233","117944620333027672168464665919056957463","133672541684000864911561701422987225907","169578652136108544469114688321338411915","232722289391612431273746847307787862308","141623566115131207436213336041731717139","158953281748759266340311535225195753377","247545310332355634950523424793895241865","256031166907824725505675868670670193946","175451472058552380681832349658120298702","311853817027332538165949666617610374685","210075602284410885326522058685769769842","60611855017330224580402834734218432668","9980599857360341827656390788390787379","231999275028405833687027102534646001389","142050831682868481852872173397644130694","84602397229293040082963473499062574501","20044839823812444971018070863877563323","316880302287178944904210817435190397101","31381625958005611511984106705575912696","262443759203455179040137099302997356259","150400160677790616749698359487798688813","244954469475971343864012036409301122481","51207354447808069804001791055823726687","130677191477203567375007460082224334385","311254852902428493210922194403869355978","50641678491956388430669459301369733711","61032058149679852947039048648508479544","103896865687136473517224605150511916116","127069349589356876085750026465613421544","240531741282617778678685342179443407507","252500733419123092872206309005507477520","282174633951692694935644861167060714094","256222144323121675045462325472195140432","332800056510445252220138592325309883826","201000281456620890255743073835730135375","73448792958206143956252330939583664894","47176353029881125860654310317958497516","85372747092838731050922156243769360166","121934297317238510151917225339884288414","199298105113699324476053896271253502603","305987743424523562261007657803457073768","332578271373714082302212956233188922864","85707507323387417093407089894269608538","337592324610162072719630524034522878225","159689974555224326998337709383564665810","121513907770785743687851223489460755100","263159628520089204996303788199814620499","24409484163938948292187955015600394921","278613904276029818108668174005828547580","97884595408554837344506541894443757373","285350679185111641448137742064365471552","241502434436545744987312266869985312309","109710689759613991511969910226267196872","300867519403138190522378070153837175470","38835658996159747843644992736508841732","27045662792659533188942443270182024026","183039463253514650377086130288177473575","321194784265044540205519152422600134845","293339044627026037321889698530838545605","309469465924372382170323123652558728830","179141824868451923387307691835717477410","170412550012939119396004151907266468563","101124675321322893867524691947824090979","323574062305044712995599487469929389042","168318884170564438960982794231254975797","323440301328635725613795315600965836764","299726596619624175472177170654079512006","103602473114103233940339552133644646946","151937390199916471500148929821272697199","294630055719569287119928096722410764605","5502226411030999168235445391743488326","237709492713661591148180411370701622034","160133278329588836030174320291614338414","164718654193588210048379036283787202261","318895572596280030481064614850393009913","105625794678151220010534258613334995450","171525996394849744618964113579322380230","28500007487840808753764996202204105073","37913314730427890554295736872308630176","20044839823812444971018070863877563323","112370176656454721914196972022221983754","194175321644719232281296344994641747224","254548480648344507742284407009317805450","220482128268559328353186149755342039558","244954469475971343864012036409301122481","51207354447808069804001791055823726687","101166875340034922373679068479993992670","269571847900362035639565496342441286782","256418798296666476805774523518877346882","298158417507942678094945153766585626486","120068880184587282725795752136940334200","54594835993296654307154233195597820636","330021271704986368367677095315441829184","327599814664093022441121622943935828015","59925346647423663980449079522473199833","82014955853456024611679679230042144208","278851313065967910761543507547408743326","115527515220290075162049093175953044036","299989198126636714156573733993913650820","213294448556391906857212549049371118840","263490630095693096826642292626586181112","160932338480336451467214458696944705234","283343160667055899199023786862760564932","279157708660503809287547621970788259022","123873615476975422252434981599327651206","129971217962467019179352851103128044377","250860330502804214174889297849495263595","102991609843635818470666589976215778269","240439141911022783734723462339182003855","202793363743893409261533722492655177310","271260758948777432772676844137658802968","267328968362199913391922639184734777126","314211101114113787980272749055626582666","97823462999447590356384018325588751537","225059414089728934821641943056306574794","165656447396307127255012879512002251740","249444518914392357466445809253814116738","286370805183098641038874168999178020230","246075868780193452058329846339475971347","109149238658214821121866501083520185382","274931341182002200398361259043361759547","71325184346980902219690219148261818858","129650409936076786758414996147515633886","317112247475317423677204114707663642090","27325322738185611260507641270052145602","107367616447542941578344375942408356489","300285660087532293658850970628462145967","268525877141148429469970574849000991927","189996594200393738372673077925219949800","198213140105215730681094258231731008141","184891822533516727712958644434093510515","19115353557363731994099114811843220997","79038761637795964648805765684345734850","128902882149936870337443259295164129554","113154045203836963579078480808034953195","198005510842886782422650019253411643378","83025252632090895271332770877767562849","120371501915973592785746251187497332979","118218281528253075506652453330357264413","127878965039670256987559504659681007628","40740353398493749857007900453406908641","267578477909356861514821290887035650438","34927914197087881788088078890731522662","251775227450215534817841879640941313941","57232494692343689854104543868947024171","183727529212311678763692498860258903838","244954469475971343864012036409301122481","51207354447808069804001791055823726687","86767848422075335359413225569731942001","218227295552677576008203045492733065212","181095903386159448290570624820171551267","247179218533745690585811172098652110681","120068880184587282725795752136940334200","54594835993296654307154233195597820636","141740127682069790114423558259866347427","316477704010955582791322267447472523","63187048706843241941664312704972329502","247968551522391108429494611348297192651","337051593811661876732399081676016962409","34878928803165743265391420845882517438","277995848221432686838506278133683853410","11697017824122517087311617910018818265","218973881269231130299018435134027159939","291890510564415199901066656884758275753","210758876591073774373637978736578474032","200250527239761914752503027883368455615","198234706684508717326646012142435182877","145179882971737664293396103053855345808","302088318758086004303980729567805182263","325958811336871408534937354256787519345","215528460073270681988474005329853421100","92050363194379008319932619040311145023","321697439226928752220244461793485040215","93967477407491536014139659089900877581","332908346302057801599677609989440193264","213143731608568175293090316742832680895","159668234636506035822203788730689677752","75826647928562700912610823867490572908","205986135277467625627247402204720193256","45723750228661365955436513170165298531","323448533975498387628426159412470316726","213021129098521690134607008702886709159","47907468715511526757985276730406936165","8742179586968129572837138384556036183","199855370282367190374246106605072742162","222971332299295787777979166163175364402","254635959042353174675989575515586827270","265506005058041221804702476103586334755","183421148836723753134588461184455386817","301117810906050557115740490178976018228","105084891337191663657951510840326766864","40674431666562476286675121721485163297","113790696770605891502963318075319290470","245691042781036476862169140629532797868","27395674634681990617273440569123507913","278953334559146885535788550666968745228","322367842193352893875612712351154441176","21014515006348027796239962877917312830","219790578819783488096716877679405672491","107930120573370948897480655002596422010","149886160597502250043861526202244608644","148036457368111821778585073294136486950","224528795045493810492566285092713523832","334052103951686436988035459254573645324","225766021613965899100168511116564135288","319129894570896501388743948290796697213","218973881269231130299018435134027159939","33121296572145274103995940583706808197","62998673367360131483676562620107340098","198721445924901549000802421885288091100","11501235161902040700338411963139778564","145179882971737664293396103053855345808","302088318758086004303980729567805182263","325958811336871408534937354256787519345","215528460073270681988474005329853421100","92050363194379008319932619040311145023","321697439226928752220244461793485040215","14841650874400346314533127056584025038","6389100180337065466916732798938932817","129726055845924031829784213162046775191","75826647928562700912610823867490572908","205986135277467625627247402204720193256","45723750228661365955436513170165298531","323448533975498387628426159412470316726","213021129098521690134607008702886709159","103280974634964154794666297107354423802","87366154614562015281588872674017432256","13937320756365416524760558985041617565","254635959042353174675989575515586827270","265506005058041221804702476103586334755","183421148836723753134588461184455386817","301117810906050557115740490178976018228","105084891337191663657951510840326766864","40674431666562476286675121721485163297","113790696770605891502963318075319290470","245691042781036476862169140629532797868","186294236919754268091225382541678211864","172727081890626788097619426706411609985","15225791138747345981765862316754999915","88498486195521898516258563821153511330","104285521828250032552078967330504028631"],"threshold":0.9},"id":"CVE-2026-111764-770d6980"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java","function":"setUp"},"deprecated":false,"digest":{"length":86,"function_hash":"295112548762344037205684050472038867249"},"id":"CVE-2026-111764-77206329"},{"source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandler.java","function":"onMessageSendStream"},"deprecated":false,"digest":{"function_hash":"146672581262999630180276534693899730926","length":4639},"id":"CVE-2026-111764-77683c90","signature_type":"Function","signature_version":"v1"},{"digest":{"line_hashes":["134542412522150502195737524598194807944","316694455432631527332777411897857536051","62121802151598125124284226606994175874","133545772649606002433008716427008977270","80288603016302501668258409629869121097","845601620902355335865735968979719536","115934399690897306279083562817156553545","37176532045082720997860611557784246250","68991067886758502176471363168469933823","317266623974799564217210043330688567578","42408286621928637630635045234222890694","15206666848596950482517395413471266442","7621928188304765086842621013840338021","56647045488108168832979370486690243539","90207215609165971998057983452670146388","320078416530803022831907512723262137139","100936658618934162589025563092840089946","208429196206103023594121326837244258374","54314468942446664812771345895229187137","20027287559778260854185583877654971876","161128967993510755485881147408928043617","175760619789812078722531436380413541459","186916211733508522936955787640864147953","247495429158068846701542830978847686791","113658252081654445371127496008399109503","1541403363241432075573203445744411354","131568390667550624260121331260002619533","181689949943980733237124319054497199482","209602447906666079555324836987867097858","146855066048036114300668573112695181640","116315960458860756621095012821752379243","275842809338723367741300956347932687266","304901692165134117377794068157753780487","66880829218055445914218434569343068168","74176465901074524784882560496724350323","276531683704891506374027406245005749901","291096142534127140505834936911587582665","207203445166187413518175014896030766524","87031599313485774694296277477281921498","130077023329823754187648424297094370542","41552268222527176977231321916775512602","243515629643180879520030337730835703058","199160752800201333368735429595589310117","261201957631202554363082715628079337043","210402762185789363508554318142211840051","208446736317636256807821465570665453532","289888299188538280720830704940204900853","329369760953054835593161628606090795231","113457645851070405214872384811845646721","224189874227847327480640975466276852429","5004363053094713264500536384185496641","331174352471454599560832454276944424521","114522162512470809799099133072033738394","92008168823939845807142562289179328625","129813416237805577696379506143387832483","31366648532587416280722132277685810407","198579038188878961675832546320151532934","99317997183139191752805752796674086431","91038025824534107071110004796254022184","298251947251747506899482456692819493817","176018884956199393801133714846413359514","167666732808677217936298533917415721325","91311219511527969400436962202625002929","108862487121585577644015783082674271474","17366038062803439927727784395089140281","2476020911532084211432743188452946592","312487165880855959062548407176565433504","230578380794189858402893656683014108175","62906804795461899794799485964801218177","32906752219330873043107529072485457180","145432030102155500913163855954375314011","44602347814453755811529801387525924858","76915589764228432755414357965517931144","32906752219330873043107529072485457180","132417835351897233163065219527771570394","252488290029614448102858473623228365410","252893499027043483758963213590400642331","17740604274391580651075857988070405041","278602396136058905210990529713380021407","223142369504171982851538435597449609063","277872245475356422284353602655283331442","147413164550179066382687536769653536521","335996708451579664960387111024022218165","77268425917882310076343917388082078286","332742210932691936766362712696473605264","117405841355789088345959612655546661883","44602347814453755811529801387525924858","76915589764228432755414357965517931144","32906752219330873043107529072485457180","205039026209417725877214827399518554840","295490958208262672363068743228370982021","42026188127085601788540457072206700996","243591747424284492541333372680567021560","67975106393269576603810409550165729709","91099339922819346447165154496403066278","187197975981534010194616104999181798143","256324651976279361762064955949309880581"],"threshold":0.9},"id":"CVE-2026-111764-77bb1741","signature_type":"Line","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandler.java"},"deprecated":false},{"id":"CVE-2026-111764-78d333aa","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"function":"enforceCreate","file":"server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java"},"deprecated":false,"digest":{"length":186,"function_hash":"45346085740744142419997094926210199372"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java","function":"onComplete"},"deprecated":false,"digest":{"length":94,"function_hash":"132915072026427104205069609097683987477"},"id":"CVE-2026-111764-79162f4d"},{"digest":{"function_hash":"201506284203070150503073453751986099690","length":282},"id":"CVE-2026-111764-797e5b48","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"function":"onListTasks_denied","file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java"},"deprecated":false},{"source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandler.java","function":"authorizeTaskAccess"},"deprecated":false,"digest":{"function_hash":"67414018469129253072782982950867588139","length":491},"id":"CVE-2026-111764-7a46d835","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"function":"request","file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java"},"deprecated":false,"digest":{"function_hash":"264679655284508079360377133725483710794","length":99},"id":"CVE-2026-111764-7cd14ce8","signature_type":"Function"},{"target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java","function":"onListTaskPushNotificationConfigs_denied"},"deprecated":false,"digest":{"length":322,"function_hash":"149706368532152370275710620816668170143"},"id":"CVE-2026-111764-7dc3d030","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553"},{"source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java","function":"onCreateTaskPushNotificationConfig"},"deprecated":false,"digest":{"length":266,"function_hash":"225591017764446987172353849909639489662"},"id":"CVE-2026-111764-81889ac9","signature_type":"Function","signature_version":"v1"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java","function":"authorizeTaskAccess_allowed"},"deprecated":false,"digest":{"function_hash":"249050328863636482625193424220515597611","length":487},"id":"CVE-2026-111764-853077b6"},{"target":{"file":"server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandler.java","function":"onGetTaskPushNotificationConfig"},"deprecated":false,"digest":{"function_hash":"142143994974781773389992370357784378415","length":488},"id":"CVE-2026-111764-8645bbd1","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553"},{"digest":{"function_hash":"79524788185103193583617175831632792864","length":497},"id":"CVE-2026-111764-8afd57d4","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java","function":"onMessageSendStream_existingTask_denied"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"232465855232223667101245226499058560967","length":587},"id":"CVE-2026-111764-8b6050e6","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"transport/grpc/src/test/java/org/a2aproject/sdk/transport/grpc/handler/GrpcHandlerTest.java","function":"testOnSetPushNotificationNoPushNotifierConfig"}},{"digest":{"function_hash":"239109157508782639446036813810723255783","length":6520},"id":"CVE-2026-111764-8d63f1ea","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandler.java","function":"onMessageSend"},"deprecated":false},{"digest":{"length":185,"function_hash":"204632667232011251896992680640257057232"},"id":"CVE-2026-111764-91aeae7c","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java","function":"onCancelTask"},"deprecated":false},{"signature_type":"Line","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"transport/grpc/src/test/java/org/a2aproject/sdk/transport/grpc/handler/GrpcHandlerTest.java"},"deprecated":false,"digest":{"line_hashes":["103279946963212335911736350649574221673","121837123797240705919810699090603641497","222296640959646423735949629053496502751","160218622437418651815672663324536949428","103279946963212335911736350649574221673","121837123797240705919810699090603641497","222296640959646423735949629053496502751","160218622437418651815672663324536949428","103279946963212335911736350649574221673","121837123797240705919810699090603641497","86311371136133631619339927911801564259","77636774985600908010545206207114136086","103279946963212335911736350649574221673","121837123797240705919810699090603641497","86311371136133631619339927911801564259","86439659264132408472115624424798606826"],"threshold":0.9},"id":"CVE-2026-111764-942f5aaf"},{"signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java","function":"onError"},"deprecated":false,"digest":{"function_hash":"321743928332309153873753592215100901254","length":112},"id":"CVE-2026-111764-945d8c00","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"5895879542972646729770085715946447309","length":98},"id":"CVE-2026-111764-959bc3e0","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"function":"onSubscribe","file":"server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java"}},{"digest":{"function_hash":"245792905636354405431029398407424647176","length":205},"id":"CVE-2026-111764-9d315d3e","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandlerReferenceTaskAuthorizationTest.java","function":"nonOwnerCannotValidateTask"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java","function":"onGetTask_allowed"},"deprecated":false,"digest":{"function_hash":"6114597776505991297644363081600886124","length":393},"id":"CVE-2026-111764-a507a00f","signature_type":"Function"},{"id":"CVE-2026-111764-a7479c89","signature_type":"Line","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java"},"deprecated":false,"digest":{"line_hashes":["21249739951356109748777978643101539661","220510949941847913076942868745477166301","250937929953959254133352442075708144252","332359917435630157601934604563873207530","219906243090644838576645730335326094963","225264602821574728347996824084356073158","230651671565673394387448117847314617888","14077858815784415935861465374183833680","205172075148607436727599054046980642763","217294056582144500666822513457195451672","210969532623685863478168399958005260879","309061689243852132061102597115968628978","53368816913996705677594699343040003720","140544179526617541082207204443917399829","99816378316581279066896424446588888380","144371398528534365038250029926863512905","167946256896536799300310886328062245494","111755238725875773403026804765118566","273334435558845482840412405109811086631","112915263704388491432775176980790167647","37148794281772378289287838738032122618","134542412522150502195737524598194807944","67289335453023252204303035130493032248","253049586750895757167126474947204780673","97826899102751551349675574014924289422","324513891160176116505305394782937440929","335603100078381088969046483157270095428","317548438476110730734334288363324004499","204976085260816609058848932084318304249","102398673095839568491931103005268708254","48576994511803670679129739362274598590","191894678589208679346654131436545316992","295175426398561733827865034688960116827","203012827551274490416446674202339967889","147573997505528615225334951470248132775","131280598717052801222014744237725298814","46715295129681513517058229207879341536","118215402612740708525550147659025970493","318235791065666307189279771207805112205","286696307512151731428487093214376181689","226886309666382882673457805072187640415","211082099070559825521499321238964353575","132850339791041584559778739536300817075","108743465796072752223245144763264108442","129342800700638986670549074954860625121","317963164228910999534066575940287420909","335159035923752769837482784695832056384","285624357305031209079335808904065491982","227614985951737115565375716740020090253","153658674067328727875127093470653395857","116017217731968091066038469488819266415","14837867832569210537389316939555094380","219816601242118250332093768536237264297","247074094294906536438307901872571846023","106604658351561153728311458183024188310","6897112215502185203348938835737281759","10874179612997808622048388264401694013","262435837527409946189589459065224037944","253655376828275421602365250849412229527","88395180928418609523333742725479858967","194980035509159043447635334646267650100","191441601008887768978985625692373901496","199702620970664342468887356746522248555","187840481180794607977183271705991888137","83351901734704420264924545794292535048","168460089253442692187446243785053857529","1269135536571574111632447344240648204","212264262838916069737425824762580906286","273403763038312467854391708768027746295","49319763837879104140979868521474204580","128377695955396377787468260077010204950","105505453776399435661055000109808863084","207884461912050501482402578335766198979","205958651467223404932270650106601120856","234164390339318044275416272610538159240","127292681729051476107999836063349665795","146067010255551275588107458415822210652","312743871745538546704417037702389625855","167561716316963234172957355499905685182","91762633863806303951639719798291380155","200730474657121033542814426416964329123","154453074583207496820928833155564934228","211667678489014249346125712522739857480","3775373242849942455016633235539813711","116565369856929850073553543761510753677","117647536085001249830278575766323799675","114572924349424572700331116933039268673","303305823452925783651143056398558317274","293949540968280903538352693917672011553","279288379845982762458357164965023444659","322350395445813700063512663967888293317","310199675831189992499601104530634353621","100579232952590662429392058447073969638","81437804977260098146033706092288363505","251862622697637882809936678679988252159","102308574431314701574317595489977405220","65019420622916991544773030129787393153","329938954978422613902502309404735067281","268546951903598787160553103843484848314","129285467053641858151009822605605999670","252704042590733162671592719731756045848","292009960049003980558802571304262045098","97880747020471980709514273472453922731","169403800564834274409462374298381128037","79857656579781679713873665099933085318","157986713923486832780766759971462656381","333789507658108186739000789380062171304","49369628945849007144890648624151057834","214231438498254070563663924527890044281","80491073414208779645887022274968860631","237402788195874293839658639210421055257","133209009892605882632020554236876352494","287801074852189186867683498055118833333","271856953372832078986854765969155776358","132788812436328379899614306118895050430","154095472091491765129707014423615926251","98615232725614586023632120173621575601","182630661747757929167846290487974373366","235646780049931381624650606273200707462","24813511160132846875972758709520898695","311569316698243565441212413698982596710","334445088530249943130571286135775890417","282056646868755043841115199289324400626","90530465303796215476980710112486440445","237831593872139477803271808390989103706","259396605515056085945913259688776489024","241892045113307103081062599329819499838","155321390330505811726203394966755566233","13680828682964174770112691193444811728","13185270604142172743593531921937743052","308825821932500317790363416395638181091","335739877842835889678655825766000724462","336460453726753208299788674314205226072","126318162438161210896102569555840701449","110922659666884908264684850319441072611","184479364968401682795940882733287618190","176512513899240816579949673816071248044","294962032552106531244430711491725879307","190398769208255773485784819093843208848","257613275441602757188720414959847921174","163147354067655261538630886636550895079","49805266219869040674650489713381921904","3347649074318008175543219192633576771","238059121100136959489819310620297186256","161393056079792388419228814523630469536","72848014638274663840899572135817598633","51929646506172722846640496855724284153","217243911474088897295669316019695608172","189925646165518559536677310106317198223","142334101749323504684161921099353382220","85586202517259122684573253131365598842","16317998009788608957870472680700476398","232084013962780015096753888752440309005","90425704415337628069099901975854519376","266243953512657868635929918931206435174","3938463669314619163702884888651103788","317277846786753583543280115315742701494","190489408618144925846894311136756669881","237811729778302425667674066381472129311","213535528516739210337143501180438033489","273351791535830955985324925058883629205","256316472411827081285614842848108587687","8938172989787298437369389398404360723","305855384630754245147008252443428010138","218949187573147107582539635176024172755","300224618740373093620536405150692692406","176601037240412640043121382623672311747","140345602879051231997666445365063821531","39012392481502407786233652196212898723","42750724670036026378498041289802318235","132192668290132982030653435875326173996","198296893782585640287971537757780675013","291021252346753513477032843975283905848","321664958341191332917298728592819352437","104939712921120974220966957735318004222","98669852203680654601748974556493271943","325176299288776385072806328701576129754","163448463352363392543862005638033235011","100028427385538634487212275871620188921","117770744428413342227480703109006444137","204777026927678435987850341624974342121","194916949033967715587847125153840363427","227351489116010371611149607134591425814","281071257010839163652863055522752901408","63882170517993553849834264526854488650","209219312955328623662024154153219010816","318539691888347876179584412449319949200","121013087809681047896159752406249995551","194177213050783946858156787507144265796","180885175345096395549476416564323801708","156876498125598790879882759224508343214","218612256305483314148083522664370306747","246569769536308220880715337729906440133","303706056147899902402517124105606500902","9928626218528132949700107492242325522","21583899751625506186169830319493659772","231674138868417394463798343679526529103","201269625956540909835345072601577811840","243480397436456933402859593089575204885","188195572386150773047363401147665464073","338954564177479419876439785405513178962","220867572358988896233416347076645464277","146262015903400122319179919151677586865","119466361322468922577108609620400671277","87980751220737707311792955658256330273","285998651550793837909203176382650874176","133119363548594665751803017121260027075","213277614197307453138149900283084279623","83874874260525357052197355971288959333","99464141688233317772113786795349380872","109676312557668628177226103727296854927","138980789119556060318848718192616246208","56665186118514205498063880493192139751","25996996240365921786503688957807605916","337687722089380891655040126651902517525","220377367584202123264835352743133216837","37199256582145742739855874602880577650","77377777959540841458204822867651326929","107360197163420055338868803742020626745","288171379196214739275962479821728559971","268135858630777240567227615290590917282","1498144344550885716417743132521408990","51669414012635440211322239358646239539","316868344074496922743937348782053436681","270689332168735094205691269177526544083","230880247362843604981397683466918379462","257624234144880799237743999063505413178","75528888424960434745003569381289774118","297081909599768605970801371391608534057","45606776725044434982378949018466848705"],"threshold":0.9}},{"source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"transport/jsonrpc/src/test/java/org/a2aproject/sdk/transport/jsonrpc/handler/JSONRPCHandlerTest.java"},"deprecated":false,"digest":{"line_hashes":["103279946963212335911736350649574221673","121837123797240705919810699090603641497","307356680253461755356971394650760614219","172061619516007398967195203699972366878","103279946963212335911736350649574221673","121837123797240705919810699090603641497","307356680253461755356971394650760614219","172061619516007398967195203699972366878","103279946963212335911736350649574221673","121837123797240705919810699090603641497","307356680253461755356971394650760614219","172061619516007398967195203699972366878","103279946963212335911736350649574221673","121837123797240705919810699090603641497","237458822856413424652168865184252337956","122903687223352327588496848154751138436","69987723212909969162060944687767062621","121837123797240705919810699090603641497","237458822856413424652168865184252337956","122903687223352327588496848154751138436"],"threshold":0.9},"id":"CVE-2026-111764-a7f66efc","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java","function":"authorizeTaskAccess_nullTaskId_skipsAuthCheck"},"deprecated":false,"digest":{"function_hash":"107668505648553541635564416099774898785","length":243},"id":"CVE-2026-111764-a841138c","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java","function":"onListTasks_allowed"},"deprecated":false,"digest":{"function_hash":"148006350406143876540249428600930445758","length":547},"id":"CVE-2026-111764-aa8f764d","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java","function":"onGetTaskPushNotificationConfig_denied"},"deprecated":false,"digest":{"length":333,"function_hash":"82713073675528765716973745725122351737"},"id":"CVE-2026-111764-ab2aac21","signature_type":"Function"},{"target":{"file":"server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandler.java","function":"onListTasks"},"deprecated":false,"digest":{"length":1113,"function_hash":"88310155033090208086303290054449575320"},"id":"CVE-2026-111764-abaaa14e","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553"},{"deprecated":false,"digest":{"line_hashes":["111778023965639062848900596886964949329","126010394243428478581590943868493758640","161682440659051478667279994203891259253","9043863290661722052388714258054026568"],"threshold":0.9},"id":"CVE-2026-111764-aeeb7757","signature_type":"Line","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AbstractA2ARequestHandlerTest.java"}},{"deprecated":false,"digest":{"function_hash":"250976677736741788770738324277876858936","length":382},"id":"CVE-2026-111764-b03ddfc2","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"function":"onCancelTask_allowed","file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java"}},{"digest":{"function_hash":"90811405098649080916284862014387937266","length":446},"id":"CVE-2026-111764-b48f4fbf","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandler.java","function":"onCreateTaskPushNotificationConfig"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandlerTest.java","function":"buildHandlerWithRouter"},"deprecated":false,"digest":{"function_hash":"157981654654093971214139823750310300024","length":284},"id":"CVE-2026-111764-b5b0cca2","signature_type":"Function"},{"signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java","function":"wrapPublisherForOwnership"},"deprecated":false,"digest":{"function_hash":"279046309612686442248205898473986685863","length":1180},"id":"CVE-2026-111764-b7b18c03","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java","function":"AuthorizationRequestHandlerDecorator"},"deprecated":false,"digest":{"function_hash":"4373080591595171220886826005876476777","length":16},"id":"CVE-2026-111764-ba38505f"},{"target":{"file":"server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandler.java","function":"onSubscribeToTask"},"deprecated":false,"digest":{"length":1382,"function_hash":"299698727802529302109099947845799474645"},"id":"CVE-2026-111764-be812cd2","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553"},{"deprecated":false,"digest":{"function_hash":"76776203678447880805438801694339191934","length":221},"id":"CVE-2026-111764-bf1cd5fb","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java","function":"newTaskStreamParams"}},{"target":{"function":"onGetTaskPushNotificationConfig","file":"server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java"},"deprecated":false,"digest":{"function_hash":"105681889307527237827305705544418774259","length":207},"id":"CVE-2026-111764-bfab2165","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"function":"AuthorizationRequestHandlerDecorator","file":"server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java"},"deprecated":false,"digest":{"length":99,"function_hash":"172313772274446370165053271207568154429"},"id":"CVE-2026-111764-c2515c98"},{"deprecated":false,"digest":{"function_hash":"62038868468793987852513752363301173191","length":1150},"id":"CVE-2026-111764-c6e6a1d0","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"function":"noAuthorizationProvider_loadsAllReferencedTasks","file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandlerReferenceTaskAuthorizationTest.java"}},{"target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java","function":"authorizeTaskAccess_delegatesWithoutChecks"},"deprecated":false,"digest":{"function_hash":"45831894159921199296539858027081203028","length":253},"id":"CVE-2026-111764-c9349b44","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553"},{"digest":{"function_hash":"328508516179109845977432004530396054161","length":426},"id":"CVE-2026-111764-cd0f7668","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"function":"spiException_propagates","file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java"},"deprecated":false},{"source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java","function":"onGetTask"},"deprecated":false,"digest":{"length":182,"function_hash":"209588267696387828362817036251153735956"},"id":"CVE-2026-111764-cf0d4567","signature_type":"Function","signature_version":"v1"},{"deprecated":false,"digest":{"length":486,"function_hash":"154780070706653037848171980682357292012"},"id":"CVE-2026-111764-cf7ef749","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"function":"onMessageSendStream","file":"server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java"}},{"id":"CVE-2026-111764-d434ed0a","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java","function":"setUp"},"deprecated":false,"digest":{"length":86,"function_hash":"295112548762344037205684050472038867249"}},{"target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java","function":"onMessageSend_newTask_checkCreateDenied"},"deprecated":false,"digest":{"function_hash":"100427201312317086844894473198871905837","length":260},"id":"CVE-2026-111764-da0bb0a8","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553"},{"deprecated":false,"digest":{"length":947,"function_hash":"127841236604642741744498091531434111032"},"id":"CVE-2026-111764-e2ae02ac","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"transport/jsonrpc/src/test/java/org/a2aproject/sdk/transport/jsonrpc/handler/JSONRPCHandlerTest.java","function":"testOnMessageSendErrorHandling"}},{"digest":{"function_hash":"177754495910334437063074623431135036169","length":298},"id":"CVE-2026-111764-e371c84b","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java","function":"onCancelTask_denied"},"deprecated":false},{"signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"function":"testDeletePushNotificationConfigNoPushConfigStore","file":"transport/grpc/src/test/java/org/a2aproject/sdk/transport/grpc/handler/GrpcHandlerTest.java"},"deprecated":false,"digest":{"function_hash":"93592506330784967556557057983696142809","length":651},"id":"CVE-2026-111764-e3e6e392","signature_type":"Function"},{"source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java","function":"onCancelTask_delegatesWithoutChecks"},"deprecated":false,"digest":{"length":314,"function_hash":"131949576861847668730032781009992940099"},"id":"CVE-2026-111764-e938e927","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"function":"onGetTask","file":"server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandler.java"},"deprecated":false,"digest":{"function_hash":"309501286259712398468642771101400238699","length":439},"id":"CVE-2026-111764-eae93c6d","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"function":"authorizeTaskAccess_passesOperationToEnforceRead","file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java"},"deprecated":false,"digest":{"function_hash":"333822587271517295595948056828116075415","length":451},"id":"CVE-2026-111764-ee42a4a1"},{"source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"function":"onGetTask_delegatesWithoutChecks","file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java"},"deprecated":false,"digest":{"length":328,"function_hash":"75656166713293216090462492719875182455"},"id":"CVE-2026-111764-ee7130b6","signature_type":"Function","signature_version":"v1"},{"signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java","function":"onSubscribeToTask_denied"},"deprecated":false,"digest":{"function_hash":"115793674088279809139726039614292361922","length":304},"id":"CVE-2026-111764-f1372367","signature_type":"Function"},{"id":"CVE-2026-111764-f17203ec","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandlerReferenceTaskAuthorizationTest.java","function":"setUpDecorated"},"deprecated":false,"digest":{"function_hash":"95446882200850076094713837642863117761","length":90}},{"deprecated":false,"digest":{"function_hash":"214124598442259282140938186846719028104","length":765},"id":"CVE-2026-111764-f30c63ec","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"function":"testListPushNotificationConfigNoPushConfigStore","file":"transport/jsonrpc/src/test/java/org/a2aproject/sdk/transport/jsonrpc/handler/JSONRPCHandlerTest.java"}},{"digest":{"line_hashes":["292276278457134277962993050697322686529","126010394243428478581590943868493758640","142101920190865847964587603273466477584","204538505019821762422170572494201788181","292276278457134277962993050697322686529","126010394243428478581590943868493758640","142101920190865847964587603273466477584","204538505019821762422170572494201788181","292276278457134277962993050697322686529","126010394243428478581590943868493758640","142101920190865847964587603273466477584","327373870755576298563183646234814947478"],"threshold":0.9},"id":"CVE-2026-111764-f5866a97","signature_type":"Line","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"compat-0.3/transport/jsonrpc/src/test/java/org/a2aproject/sdk/compat03/transport/jsonrpc/handler/JSONRPCHandler_v0_3_Test.java"},"deprecated":false},{"deprecated":false,"digest":{"length":425,"function_hash":"81098258928253719108281351358074452603"},"id":"CVE-2026-111764-f5c06c8c","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"function":"onMessageSend","file":"server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java"}},{"signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java","function":"newTaskParams"},"deprecated":false,"digest":{"function_hash":"76776203678447880805438801694339191934","length":221},"id":"CVE-2026-111764-f7d2e8df","signature_type":"Function"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java","function":"authorizeTaskAccess_denied"},"deprecated":false,"digest":{"function_hash":"143324341584682871864078827762110949200","length":308},"id":"CVE-2026-111764-fb50cbe5"},{"deprecated":false,"digest":{"function_hash":"74998893333959063359079389435066499935","length":1081},"id":"CVE-2026-111764-fd840edd","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AbstractA2ARequestHandlerTest.java","function":"init"}},{"id":"CVE-2026-111764-fd9daf49","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"function":"onMessageSend_newTask_alreadyRecorded_skipsOwnership","file":"server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java"},"deprecated":false,"digest":{"length":528,"function_hash":"326647941171474878292541399020744639998"}},{"deprecated":false,"digest":{"function_hash":"192365252993608256984970087448042814979","length":776},"id":"CVE-2026-111764-feb52f04","signature_type":"Function","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553","target":{"file":"compat-0.3/transport/jsonrpc/src/test/java/org/a2aproject/sdk/compat03/transport/jsonrpc/handler/JSONRPCHandler_v0_3_Test.java","function":"testOnGetPushNotificationNoPushNotifierConfig"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"}]}