CVE-2026-111761
- Source
- https://cve.org/CVERecord?id=CVE-2026-111761
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111761.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-111761
- Aliases
- Published
- 2026-10-20T14:54:46Z
- Modified
- 2026-10-21T09:36:46Z
- Severity
-
- 5.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N CVSS Calculator
- Summary
- A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery
- Details
-
A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, BasePushNotificationSender in server-common sends task data to the URL in TaskPushNotificationConfig without destination validation, scheme restrictions, or bounds on redirects. InMemoryPushNotificationConfigStore.setInfo stores the URL verbatim, and onCreateTaskPushNotificationConfig does not validate the destination. In the default deployment with push notifications enabled, an unauthenticated caller can register a destination through an inline SendMessage configuration or CreateTaskPushNotificationConfig for an existing task, causing task status and artifact updates to send requests from the server's network position to loopback, private, link-local cloud-metadata, IPv6 unique-local, unspecified, or multicast destinations where routing permits. JdkA2AHttpClient and VertxA2AHttpClient follow redirects, allowing a webhook redirect to bypass creation-time destination checks and convert a POST into a GET; hostname-only checks also do not prevent DNS rebinding. Direct POST delivery can push attacker-influenced task data into internal services, whereas a redirected POST-to-GET request drops the body. The sender discards the fetched response and does not expose delivery success or failure, so the demonstrated behavior does not provide response read-back. No credentials or user interaction are required. This issue is fixed in version 1.3.0.Final.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-918" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111761.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111761.json
- https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b
- https://github.com/a2aproject/a2a-java/pull/1096
- https://github.com/a2aproject/a2a-java/releases/tag/v1.3.0.Final
- https://github.com/a2aproject/a2a-java/security/advisories/GHSA-q78c-5jjq-57g8
- https://nvd.nist.gov/vuln/detail/CVE-2026-111761
Affected packages
Git / github.com/a2aproject/a2a-java
Affected ranges
- Type
- GIT
- Repo
- https://github.com/a2aproject/a2a-java
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "0" }, { "fixed": "1.3.0.Final" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v1.3.0.Final", "range": [ { "fixed": "43bde91e3319f0a92db3ac2104215dcdbbb77679" } ], "source": "REFERENCES_TAG" } ] }
Affected versions
0.*
0.2.3
0.2.5
0.2.5.Beta2
1.*
1.0.0.Beta1
Other
nightly-metrics
v0.*
v0.3.0.Alpha1
v0.3.0.Beta1
v0.3.0.Beta2
v0.3.0.Final
v1.*
v1.0.0.Alpha1
v1.0.0.Alpha2
v1.0.0.Alpha3
v1.0.0.Alpha4
v1.0.0.CR1
v1.0.0.Final
v1.1.0.Final
v1.2.0.Final
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111761.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"line_hashes": [
"244620105572644217416796521043673679897",
"254267032419478228965642226777106514988",
"100238973510472504841002459826181751370",
"122436646926956251253252528949539480022",
"224432309779779895177499381464762294306",
"35647441542631293460498100570679863913",
"180999923213191884622906997831310282828",
"222454100375300958745381605286419680195",
"137026380366763478126928223967892120541",
"68373370882436859564214649608579345916",
"339425237029073214194386938285423299362",
"267414783431894123876215098517556372457",
"302997787562838535920182738704280782384",
"227691018107438283576405624468554714790",
"297235634268695338384067102471552979012",
"297149906141209969725966034346535002349",
"321527251983318555152337854790666201497",
"269784841026451011653080152442555297619",
"108318802981310434692409715933597930348",
"211354909441449177589369427139747837285",
"76363815818934138312635345021445082384",
"317263641072757088809022550476980764108",
"213239374963121445175148984019519012279",
"2010825970649546168007569038516565005",
"145129413269559205601052639470257016450",
"245806583991983791595303989745811218530",
"77161316495127344665552050497247087600",
"56106776760615126619250642233648975488",
"102665362000851881923273280697863204853",
"13646141758938974490158614448118132308",
"239646808357681112109307432231625411813",
"220426664379138367828023219508396831608",
"332146767946203113504548945949251724392",
"306715395854070318247067801060452247027",
"306678296845878494369341589373536970242",
"205827101726335568316822816401198463275",
"32319042150213853024006116774621805901",
"163166033882030256978895326898877306585",
"236126550553356617768485914945844621179",
"47527756131265126820287659998862043171",
"331215131072525171392978028346263007484",
"49995286486467312755081339012817632954",
"307926355357926582254272567263091992666",
"255798782399849599537757019728965026254",
"255407997467308771883148889575791531693",
"239021839033758172013678731706285552990"
],
"threshold": 0.9
},
"id": "CVE-2026-111761-070aa376",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "68700418044791783547228816044463494141",
"length": 148
},
"id": "CVE-2026-111761-09b51ba8",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/tasks/PushNotificationSenderTest.java",
"function": "setUp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"31544325588870301888166175672986442172",
"278301685630891122463881086177189507164",
"197388619177440026844140555232858799765",
"55331396843212050405403976820998113825",
"252707378710353366466184430286657607383",
"74947488658084257839660905039369707469",
"109993903720252957967771444069732211643",
"141030993582078015250634971076987287058",
"6555011541209452114970026561381389406",
"64503888003085015778447562626261834820",
"190261145792825828180586591834231627282"
],
"threshold": 0.9
},
"id": "CVE-2026-111761-0a82623a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b",
"target": {
"file": "extras/http-client-vertx/src/main/java/org/a2aproject/sdk/client/http/vertx/VertxA2AHttpClient.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "160886334612543300790606557196363066160",
"length": 267
},
"id": "CVE-2026-111761-2ae5a9f7",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java",
"function": "BasePushNotificationSender"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"45777562012496679566622241583193759155",
"5292712662818365788809134375578616570",
"279726520075602093190648428461262234595",
"55331396843212050405403976820998113825",
"155446071635921272237657427357428078099",
"106695159439763015848872402348490660470",
"336706331953015670292242317608691222762",
"272430893185350181526512553314361884761",
"126756081517771292008349092552148507422",
"38661811721448211422322449020988165303"
],
"threshold": 0.9
},
"id": "CVE-2026-111761-2cd831fe",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b",
"target": {
"file": "extras/http-client-android/src/main/java/org/a2aproject/sdk/client/http/android/AndroidA2AHttpClient.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"270152563006339617380551210451725173765",
"237629647425122130282974699332125319037",
"47419039559638004349212286787553351645",
"124160628773578787898094397006732580559",
"153709594765461648794830523597379339215",
"170706311671180393636869448648184292358",
"206087379447941368027522181519791484847",
"82220865344866488405477848840906207328",
"153709594765461648794830523597379339215",
"241769099810839065569379607961564375757",
"124490949286080401987582981656557856666",
"121813607368528839877164658292157251243",
"265374998546150100197114988163682804211",
"172966072760508809270719639142339978034"
],
"threshold": 0.9
},
"id": "CVE-2026-111761-42b31987",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/tasks/PushNotificationSenderTest.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"165274628048481663890544152588656114373",
"123483957779212259742873887725168821710",
"209370696152766427707066428042234728098",
"81619916438582663445016929422161264012",
"75765808375875084829729131818982306663",
"307842672000498076739574047368563414496",
"99277404533833130416637732528124046162",
"36071154879961230623472884567497379708",
"92636030953861229146931428394305765764",
"306872316622127508953690355380390593912",
"133201171962155161219233531209478007213",
"293554939789671915890525220743604126667",
"245010258203155254956452867094105343355",
"90181869145346877576821510687080992654",
"184055591605462981036315793550220090832",
"336578356502186803615329139170681274701",
"144010676131597112747166624314569387418",
"28231595507485570231106523610749190758",
"50530693290009164840420874823033225552",
"326183545667111130147530493099893562077",
"260985670929095321279969327916140864285",
"143990017622019209579669478754965464122",
"56173986258392831167920542964614554849",
"46258426413078669511970478529372510995",
"235106529867754643537358372769073605087",
"102021317903642352816118571492631330373",
"98381929839509404100828760100921645723",
"278862451920268984969947871438198414669",
"28231595507485570231106523610749190758",
"50530693290009164840420874823033225552",
"326183545667111130147530493099893562077"
],
"threshold": 0.9
},
"id": "CVE-2026-111761-43f934ec",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b",
"target": {
"file": "extras/push-notification-config-store-database-jpa/src/test/java/org/a2aproject/sdk/extras/pushnotificationconfigstore/database/jpa/JpaPushNotificationConfigStoreTest.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"236551226987071516529032878816758635625",
"298091824596797426018062496412315110951",
"289098900547231551160397536180209554903",
"186827325583017179155703005676224197025",
"13996129198836813820229641966089389018",
"206613714787137512943838075933272613948",
"86592454960793038776117514554902841337",
"111778023965639062848900596886964949329",
"28291407662031267643085604950240322770",
"90795073403637242329493072077890645688"
],
"threshold": 0.9
},
"id": "CVE-2026-111761-46b55c28",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandlerTest.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "254712268611160099921505775961149141382",
"length": 932
},
"id": "CVE-2026-111761-5551b475",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandler.java",
"function": "build"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "267409823853126610248209559840394404859",
"length": 213
},
"id": "CVE-2026-111761-586207cf",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b",
"target": {
"file": "extras/http-client-vertx/src/main/java/org/a2aproject/sdk/client/http/vertx/VertxA2AHttpClient.java",
"function": "post"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "297457625669281986449209899115145248232",
"length": 165
},
"id": "CVE-2026-111761-5fca957d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/tasks/InMemoryPushNotificationConfigStoreTest.java",
"function": "setUp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "36531493374730262799396220962431939848",
"length": 1246
},
"id": "CVE-2026-111761-6a53aeee",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b",
"target": {
"file": "extras/push-notification-config-store-database-jpa/src/test/java/org/a2aproject/sdk/extras/pushnotificationconfigstore/database/jpa/JpaPushNotificationConfigStoreTest.java",
"function": "testSendNotificationWithToken"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "60448450930407039982650232984398057176",
"length": 316
},
"id": "CVE-2026-111761-7593c711",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b",
"target": {
"file": "extras/http-client-android/src/main/java/org/a2aproject/sdk/client/http/android/AndroidA2AHttpClient.java",
"function": "post"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "319736472157514223509442076090460896308",
"length": 1420
},
"id": "CVE-2026-111761-82bbc686",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/tasks/InMemoryPushNotificationConfigStoreTest.java",
"function": "testSendNotificationWithToken"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "274332622591957583720326966841804246797",
"length": 577
},
"id": "CVE-2026-111761-83feae64",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/tasks/InMemoryPushNotificationConfigStoreTest.java",
"function": "setupBasicMockHttpResponse"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "105548166151080734170274148252853340614",
"length": 545
},
"id": "CVE-2026-111761-8764dbad",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandler.java",
"function": "onCreateTaskPushNotificationConfig"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "75675301753110435362949730830533671491",
"length": 121
},
"id": "CVE-2026-111761-897b8049",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java",
"function": "BasePushNotificationSender"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "93980708127990097776155987365789219416",
"length": 2002
},
"id": "CVE-2026-111761-89c763a4",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java",
"function": "dispatchNotification"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"206980361190793289814124548523772244059",
"77819840931014612384530682078410766524",
"19569124643187349643645141566932204775",
"101085579785743831293091310647171663213",
"99336499304419461297465730489893956667",
"187536894249117192303154975112161018422",
"184055591605462981036315793550220090832",
"154254517072861040703465773111627508802",
"49634455247513331290891086846287270045",
"135436512141767726060995137463350971306",
"180347706140002232789343744961356920949",
"186004037116230244666633270444693386911",
"135989349229494870284583413313449607760",
"31301705418372574007491205727162503783",
"50530693290009164840420874823033225552",
"326183545667111130147530493099893562077"
],
"threshold": 0.9
},
"id": "CVE-2026-111761-940f653b",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/tasks/InMemoryPushNotificationConfigStoreTest.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "85454586256366233082583368603818545853",
"length": 885
},
"id": "CVE-2026-111761-99268b7f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandler.java",
"function": "initConfig"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "281628569271179130725590585908274430543",
"length": 1036
},
"id": "CVE-2026-111761-a4dd0086",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandlerTest.java",
"function": "init"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "262356045621550411692769833341949477200",
"length": 1143
},
"id": "CVE-2026-111761-ac576240",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b",
"target": {
"file": "compat-0.3/server-conversion/src/test/java/org/a2aproject/sdk/compat03/conversion/AbstractA2ARequestHandlerTest_v0_3.java",
"function": "init"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "85311135866410959327574530966420341957",
"length": 239
},
"id": "CVE-2026-111761-ad165f0c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java",
"function": "BasePushNotificationSender"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "137521440703589846159760941002028721051",
"length": 132
},
"id": "CVE-2026-111761-aea33623",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b",
"target": {
"file": "extras/push-notification-config-store-database-jpa/src/test/java/org/a2aproject/sdk/extras/pushnotificationconfigstore/database/jpa/JpaPushNotificationConfigStoreTest.java",
"function": "setUp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "167500594880541970988741630757293552424",
"length": 726
},
"id": "CVE-2026-111761-af9e8dd4",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/tasks/PushNotificationSenderTest.java",
"function": "testSendNotificationSkipsWhenFormatterReturnsNull"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"302174196612865062789232168130295147053",
"157757082064378641740192695741142874002",
"191637633944832106192750158258735129255",
"302940694993425246047158017173866079892",
"325769033342142666006670283579987110318",
"138370006435254220824707408127321280303",
"334483587269079601565956026588120349234",
"195184916912165073403206263175767567505",
"13996129198836813820229641966089389018",
"206613714787137512943838075933272613948",
"86592454960793038776117514554902841337",
"111778023965639062848900596886964949329"
],
"threshold": 0.9
},
"id": "CVE-2026-111761-b0a967a7",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AbstractA2ARequestHandlerTest.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "329016171195576255136421666196389057456",
"length": 159
},
"id": "CVE-2026-111761-b1f9ba44",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java",
"function": "BasePushNotificationSender"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"302174196612865062789232168130295147053",
"157757082064378641740192695741142874002",
"191637633944832106192750158258735129255",
"49311856289561375785956981022981911252",
"325769033342142666006670283579987110318",
"138370006435254220824707408127321280303",
"334483587269079601565956026588120349234",
"195184916912165073403206263175767567505",
"252297831880423685057018770328017825403",
"206613714787137512943838075933272613948",
"86592454960793038776117514554902841337",
"111778023965639062848900596886964949329"
],
"threshold": 0.9
},
"id": "CVE-2026-111761-b53570a6",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b",
"target": {
"file": "compat-0.3/server-conversion/src/test/java/org/a2aproject/sdk/compat03/conversion/AbstractA2ARequestHandlerTest_v0_3.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "48988855597519257059807119747340245752",
"length": 1102
},
"id": "CVE-2026-111761-be7a3303",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AbstractA2ARequestHandlerTest.java",
"function": "init"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "53504664424411017795762305237640890692",
"length": 1379
},
"id": "CVE-2026-111761-be92aa93",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandler.java",
"function": "initMessageSend"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "174029187015159285018676459265519189436",
"length": 146
},
"id": "CVE-2026-111761-c4352afa",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandler.java",
"function": "shouldAddPushInfo"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"1387041056332918291602422789151332202",
"121800772706568564777791315409851999059",
"155855451047595949039389560627846282750",
"65392479243097883018630640916177264726",
"289386314864538027116540745190615428254",
"197374022937042301837162162025386244690",
"22007423316190502663955256112115414491",
"191566521422232287249470273381670202628",
"101780729728574165480364773834986441024",
"20027287559778260854185583877654971876",
"32209077291502206697096978583158692946",
"78376015646387082915557273748747100413",
"204341884406114106303620228503863985722",
"132817665785334391653509144650851549302",
"45586886500904142638823888799729775161",
"160646960213597272669531013225821375134",
"235200272295225978923875048883193135527",
"98133035953037259965147628431980408558",
"312468354715073134048971143763682463214",
"254234629380279155361096310099102120453",
"29766851877156580548113167023669163540",
"330706960072618265321290819952598816204",
"250880031742557731368281785714864651910",
"180336505752041458103346156091706570738",
"123961862717393636583367384916543753045",
"245408195432820852972536279614222423013",
"47716443737610122978860928727133023862",
"323680803914468716125714871574879602938",
"313681144769741020724276768479384283063",
"210671107872145903664149722080737509592",
"310809341998682119444757010413710134164",
"289470805404706035019322425669459606323",
"172044497642736905281059601610263107366",
"115769557904867045046923162365971569256",
"136383805946817752216163671646542585908",
"339607669884642610041625554342407170800",
"3171825967874334871817527097026105626"
],
"threshold": 0.9
},
"id": "CVE-2026-111761-cce046ba",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandler.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "66823060567504727969961209272079017347",
"length": 138
},
"id": "CVE-2026-111761-d394bcec",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java",
"function": "BasePushNotificationSender"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"149827066191110844136000625392035459384",
"173363871580941101671373033517122027903",
"42141396146126543827556691186213499146"
],
"threshold": 0.9
},
"id": "CVE-2026-111761-d56b6f49",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b",
"target": {
"file": "http-client/src/main/java/org/a2aproject/sdk/client/http/A2AHttpClient.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"175726866628377098870546532950496783500",
"215628170622124715715535161201649625978",
"264686129463801275352613387392394137926",
"70114030276107021255825670662108585158",
"333395636775360347258584806378620897195",
"71031171397334140720747866058825647797",
"170744532942455200678886765886949221273",
"99274279473754017690435387994074637995",
"195097291466220749168710234782868304794",
"189140509629241724672665665676870892876",
"9033146801021013062242787874285452898",
"60874965552211431154335231734033953333",
"107326199521294085305811904760663866685",
"106546462493792903086494602830410822916",
"81745163744666750604676685751176101681",
"239127203116889655279710609354403634736",
"7152986475998757803119044120633725507",
"85293911247829598791254393205453683661",
"157802332603953034273237800488557452600",
"168143265968857094461132188963451750101",
"79220618232715319831460138688307177992"
],
"threshold": 0.9
},
"id": "CVE-2026-111761-db5fdbca",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b",
"target": {
"file": "http-client/src/main/java/org/a2aproject/sdk/client/http/JdkA2AHttpClient.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"327058435350615729751790206677169620814",
"96470080507136311324271689966675395971",
"127039563436862479157483101471982661166"
],
"threshold": 0.9
},
"id": "CVE-2026-111761-f8756c1a",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b",
"target": {
"file": "http-client/src/test/java/org/a2aproject/sdk/client/http/JdkA2AHttpClientTest.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "41130411448596330981340946036453641908",
"length": 1420
},
"id": "CVE-2026-111761-fbed1055",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b",
"target": {
"file": "extras/push-notification-config-store-database-jpa/src/test/java/org/a2aproject/sdk/extras/pushnotificationconfigstore/database/jpa/JpaPushNotificationConfigStoreTest.java",
"function": "testSendNotificationSuccess"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "216859951416356590918422961764765110829",
"length": 1011
},
"id": "CVE-2026-111761-fd789826",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/tasks/PushNotificationSenderTest.java",
"function": "testSendNotificationUsesFormatterForVersionedConfig"
}
}
]
vanir_signatures_modified
"2026-10-21T09:36:46Z"