CVE-2026-111764
- Source
- https://cve.org/CVERecord?id=CVE-2026-111764
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111764.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-111764
- Aliases
- Published
- 2026-10-20T15:05:26Z
- Modified
- 2026-10-21T09:36:46Z
- Severity
-
- 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
- Summary
- A2A Java SDK has a fail-open default task authorization
- Details
-
A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, the default InMemoryTaskStore configuration performs no authorization on task reads: the no-argument constructor sets authorizationProvider to null, and InMemoryTaskStore.get(String taskId) returns the stored task without checking the caller or owner. Authorization depends on supplying a TaskAuthorizationProvider and routing requests through AuthorizationRequestHandlerDecorator, whether installed through CDI or explicitly by the application. Default store wiring and manually constructed DefaultRequestHandler.builder().build() handlers, including integrations such as Spring, leave task reads unprotected when no effective authorization-provider and decorator check is installed. In a multi-caller deployment using the default configuration, a caller who knows or guesses another caller's task ID can retrieve the task status, context ID, message history, and artifacts. The default/reference transport endpoints do not enforce authentication, so the task-read disclosure is reachable by an unauthenticated caller rather than requiring a privileged account. This issue is fixed in version 1.3.0.Final.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-1188", "CWE-862" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111764.json" }- References
-
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/111xxx/CVE-2026-111764.json
- https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553
- https://github.com/a2aproject/a2a-java/pull/1095
- https://github.com/a2aproject/a2a-java/releases/tag/v1.3.0.Final
- https://github.com/a2aproject/a2a-java/security/advisories/GHSA-qw47-mcm5-934w
- https://nvd.nist.gov/vuln/detail/CVE-2026-111764
Affected packages
Git / github.com/a2aproject/a2a-java
Affected ranges
- Type
- GIT
- Repo
- https://github.com/a2aproject/a2a-java
- Events
-
Introduced0 Unknown introduced commit / All previous commits are affectedFixedFixed
- Database specific
-
Show details
{ "extracted_events": [ { "range": [ { "introduced": "0" }, { "fixed": "1.3.0.Final" } ], "source": "AFFECTED_FIELD", "strategy": "StringRangeExpression" }, { "range": [ { "fixed": "efb4e985e99390c4fc1f78c0a187a4254c0a2553" } ], "source": "REFERENCES_COMMIT" }, { "original_tag": "v1.3.0.Final", "range": [ { "fixed": "43bde91e3319f0a92db3ac2104215dcdbbb77679" } ], "source": "REFERENCES_TAG" } ] }
Affected versions
0.*
0.2.3
0.2.5
0.2.5.Beta2
1.*
1.0.0.Beta1
Other
nightly-metrics
v0.*
v0.3.0.Alpha1
v0.3.0.Beta1
v0.3.0.Beta2
v0.3.0.Final
v1.*
v1.0.0.Alpha1
v1.0.0.Alpha2
v1.0.0.Alpha3
v1.0.0.Alpha4
v1.0.0.CR1
v1.0.0.Final
v1.1.0.Final
v1.2.0.Final
Database specific
source
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-111764.json"
vanir_signatures
[
{
"deprecated": false,
"digest": {
"function_hash": "285693028531848587005692567093995901872",
"length": 717
},
"id": "CVE-2026-111764-02b4eefe",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "transport/jsonrpc/src/test/java/org/a2aproject/sdk/transport/jsonrpc/handler/JSONRPCHandlerTest.java",
"function": "testOnGetPushNotificationNoPushNotifierConfig"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "295112548762344037205684050472038867249",
"length": 86
},
"id": "CVE-2026-111764-04a6726d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java",
"function": "setUp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "154110591467771215821298590905595886031",
"length": 137
},
"id": "CVE-2026-111764-071c609d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandlerReferenceTaskAuthorizationTest.java",
"function": "nullTaskId_skipsAuthorizationCheck"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "228114185604918191936866316574080881168",
"length": 293
},
"id": "CVE-2026-111764-07908d14",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandler.java",
"function": "onDeleteTaskPushNotificationConfig"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"111778023965639062848900596886964949329",
"126010394243428478581590943868493758640",
"161682440659051478667279994203891259253",
"9043863290661722052388714258054026568",
"82732963541973358944114500977125936510",
"130933186291235563290983547304063659491",
"261771354232614418425492521858326430872",
"244179453235699034589827814889864001227"
],
"threshold": 0.9
},
"id": "CVE-2026-111764-0911cc63",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandlerTest.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "39638912097206098207597065137710620358",
"length": 431
},
"id": "CVE-2026-111764-0c3d6017",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java",
"function": "onCreateTaskPushNotificationConfig_denied"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "82396674588425263098318568798080975859",
"length": 69
},
"id": "CVE-2026-111764-0e0d7f85",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java",
"function": "setUp"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"111778023965639062848900596886964949329",
"126010394243428478581590943868493758640",
"155247045046437277212353022012146827317",
"305565900897901080717149132727825958084"
],
"threshold": 0.9
},
"id": "CVE-2026-111764-0f39eae2",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "compat-0.3/server-conversion/src/test/java/org/a2aproject/sdk/compat03/conversion/AbstractA2ARequestHandlerTest_v0_3.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "47144438115386259795484953526633303412",
"length": 678
},
"id": "CVE-2026-111764-152f275f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java",
"function": "onMessageSend_returnsMessage_noOwnershipRecording"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "326189542999554120036052200440463795276",
"length": 66
},
"id": "CVE-2026-111764-1dc0b0da",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java",
"function": "onNext"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "203691290638916526701958942756306038930",
"length": 878
},
"id": "CVE-2026-111764-1f4d6283",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandler.java",
"function": "build"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "256517085171756763084896984443522858674",
"length": 1068
},
"id": "CVE-2026-111764-21a57718",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "transport/jsonrpc/src/test/java/org/a2aproject/sdk/transport/jsonrpc/handler/JSONRPCHandlerTest.java",
"function": "testDeletePushNotificationConfigNoPushConfigStore"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "232465855232223667101245226499058560967",
"length": 587
},
"id": "CVE-2026-111764-2323f338",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "transport/grpc/src/test/java/org/a2aproject/sdk/transport/grpc/handler/GrpcHandlerTest.java",
"function": "testOnGetPushNotificationNoPushNotifierConfig"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "2083571121491578606638591570779765487",
"length": 1432
},
"id": "CVE-2026-111764-2de2657b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java",
"function": "onMessageSendStream_newTask_recordsOwnershipOnFirstTaskEvent"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "163135939505130862244845532032428427930",
"length": 132
},
"id": "CVE-2026-111764-31ad3f0e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java",
"function": "onListTasks"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "121500022159485159092922342958710457720",
"length": 102
},
"id": "CVE-2026-111764-31e891eb",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java",
"function": "request"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "182032279263544039612495195166233042119",
"length": 838
},
"id": "CVE-2026-111764-33177160",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "transport/jsonrpc/src/test/java/org/a2aproject/sdk/transport/jsonrpc/handler/JSONRPCHandlerTest.java",
"function": "testOnSetPushNotificationNoPushNotifierConfig"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "244617793292112661852531616936509496937",
"length": 203
},
"id": "CVE-2026-111764-3677775b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java",
"function": "onDeleteTaskPushNotificationConfig"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "43279170985129789382776379516818480128",
"length": 470
},
"id": "CVE-2026-111764-3828ef31",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java",
"function": "onNext"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "4000261108362279448506005667375869456",
"length": 825
},
"id": "CVE-2026-111764-38f83a0c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "transport/grpc/src/test/java/org/a2aproject/sdk/transport/grpc/handler/GrpcHandlerTest.java",
"function": "testListPushNotificationConfigNoPushConfigStore"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "208123780512230640776629664411051444592",
"length": 490
},
"id": "CVE-2026-111764-3a5c087f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java",
"function": "onMessageSend_existingTask_denied"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "102144624635585422532211560063482132734",
"length": 215
},
"id": "CVE-2026-111764-3b3daf16",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java",
"function": "enforceListRead"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "109187266290794778467591270667257373065",
"length": 1327
},
"id": "CVE-2026-111764-3bc92a57",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java",
"function": "onMessageSendStream_messageOnly_noOwnershipRecording"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "184737205227788149739553744493513841176",
"length": 336
},
"id": "CVE-2026-111764-3d60323f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java",
"function": "onDeleteTaskPushNotificationConfig_denied"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "40762169067706210875392646913419648952",
"length": 278
},
"id": "CVE-2026-111764-442afe83",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandler.java",
"function": "onListTaskPushNotificationConfigs"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "317608140284980890642960403777340713126",
"length": 278
},
"id": "CVE-2026-111764-4606bd54",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java",
"function": "testTask"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "277491264820271387286391522625520757352",
"length": 1122
},
"id": "CVE-2026-111764-4b6f6616",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "compat-0.3/server-conversion/src/test/java/org/a2aproject/sdk/compat03/conversion/AbstractA2ARequestHandlerTest_v0_3.java",
"function": "init"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "199867628089020089085189516705454190336",
"length": 209
},
"id": "CVE-2026-111764-564378cc",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java",
"function": "onListTaskPushNotificationConfigs"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "271355244793999333974315373556626435163",
"length": 208
},
"id": "CVE-2026-111764-5910af2f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java",
"function": "enforceWrite"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "206202196633281912219370257068998153136",
"length": 1015
},
"id": "CVE-2026-111764-5b6f38d7",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandlerTest.java",
"function": "init"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "98045694500391460090021174867189380402",
"length": 102
},
"id": "CVE-2026-111764-5c64ca44",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java",
"function": "init"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "300397387158550987129409696804908109810",
"length": 1162
},
"id": "CVE-2026-111764-5cdd4a35",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "compat-0.3/transport/jsonrpc/src/test/java/org/a2aproject/sdk/compat03/transport/jsonrpc/handler/JSONRPCHandler_v0_3_Test.java",
"function": "testDeletePushNotificationConfigNoPushConfigStore"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "118618980946591091860480478257896691757",
"length": 60
},
"id": "CVE-2026-111764-5ebf90d0",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java",
"function": "onSubscribe"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "295373700472228121852403474465773281797",
"length": 772
},
"id": "CVE-2026-111764-5f7a1b4a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandler.java",
"function": "initConfig"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "200646463741947110494788206407291603753",
"length": 889
},
"id": "CVE-2026-111764-5fee14e8",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "compat-0.3/transport/jsonrpc/src/test/java/org/a2aproject/sdk/compat03/transport/jsonrpc/handler/JSONRPCHandler_v0_3_Test.java",
"function": "testOnSetPushNotificationNoPushNotifierConfig"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "210355511606572239134639561559782658702",
"length": 199
},
"id": "CVE-2026-111764-623b32a9",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java",
"function": "authorizeTaskAccess"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "146261132853462999046910539545002863155",
"length": 309
},
"id": "CVE-2026-111764-6547e7a5",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java",
"function": "onGetTask_denied"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "115356838543541701676318697339909172895",
"length": 284
},
"id": "CVE-2026-111764-65b188ba",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandler.java",
"function": "onCancelTask"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"300830275633453035223164091612992146142",
"227500042401767958867223137058047227447",
"218236314445356600269777127323874032000",
"237384421196322437557210229836792020058",
"221059294307933936084358904054274479979",
"239216346660205586715477959762632129279",
"107591876415196999894163909742473371062",
"100715074675029368923461520156325092721",
"265836720085693923356895034292652629750",
"134564245773458751072568510139545491037",
"265302591661457635098807100878476731731",
"201889463868182825827397389609784927613",
"116075626922247006163563702472395142180",
"134137802887801608613157120764419374822",
"94774301941556102994344948032979863379",
"317923707042491134204285320410195408685",
"53267912824027025672503418945319362787",
"283701008509459079237151615551560328756",
"87277363032206602094764482476882730774",
"155738837399868613793835331885062012844",
"58959165960099362445183865737860609321",
"6475660302364584081228307847259283136",
"215926006004950488918027142257432697861",
"235978272505085489169446644254270456339",
"120810620653783443135683842328971130007"
],
"threshold": 0.9
},
"id": "CVE-2026-111764-6a476644",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandlerReferenceTaskAuthorizationTest.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "118618980946591091860480478257896691757",
"length": 60
},
"id": "CVE-2026-111764-6bad1681",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java",
"function": "onSubscribe"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "273775917064472954589366759189977912030",
"length": 756
},
"id": "CVE-2026-111764-6c62394e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java",
"function": "onMessageSend_existingTask_allowed_recordsOwnershipIfNeeded"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "271355244793999333974315373556626435163",
"length": 208
},
"id": "CVE-2026-111764-702ba85a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java",
"function": "enforceRead"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "105862969906421985112179595695767212276",
"length": 562
},
"id": "CVE-2026-111764-70b6c735",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java",
"function": "onMessageSend_newTask_createsTask_recordsOwnership"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "30525602181776342616085190782745198408",
"length": 185
},
"id": "CVE-2026-111764-72154f89",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandlerReferenceTaskAuthorizationTest.java",
"function": "ownerCanValidateOwnActiveTask"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "88864180209136355152669737512024448647",
"length": 339
},
"id": "CVE-2026-111764-748a0149",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java",
"function": "onListTasks_delegatesWithoutChecks"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "295112548762344037205684050472038867249",
"length": 86
},
"id": "CVE-2026-111764-766ffe5a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java",
"function": "setUp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "160088145120967179902291563608686484601",
"length": 191
},
"id": "CVE-2026-111764-76fb110c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java",
"function": "onSubscribeToTask"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"253678016618954122971322840571429936657",
"76738824961157084985615220847696783930",
"281629979146234503073053832675395468193",
"113254696215345723026982664678784956097",
"89368892506915845474529812422868870467",
"142958729827478120173853194057325603716",
"45907288363292190947519767303737792385",
"58267305725858522583541596415204910056",
"294096781746170627757133274383902972344",
"28862579680672022046152587276600331154",
"144335755874353716676358917519571566167",
"74534578455696761981361658469884356209",
"174531285607834070935573490580745467599",
"86493447288996178124983854277110515097",
"149076521523770829274660366290090849101",
"115169008776908005803693422018001681792",
"210969532623685863478168399958005260879",
"309061689243852132061102597115968628978",
"53368816913996705677594699343040003720",
"140544179526617541082207204443917399829",
"138254227162892273362791181045176920947",
"103292745284941649334843206532294393947",
"28572831104662890643649653274118436729",
"32568666914228599150771832073697193720",
"281318996475693492322858856026041690064",
"280542075500440235210257907936189520901",
"281579172994400488933685891209243185273",
"253360289737244292774927774859422864690",
"167347944272259052868001740467317398250",
"35922224230033875001961126093187436364",
"335603100078381088969046483157270095428",
"115934399690897306279083562817156553545",
"230986947174787568676511523470521222843",
"118527998098041751972149865811119076018",
"220138988179861829200032023497813029512",
"129441905901296520910519423912460906425",
"71610116587560082346455530550777127079",
"221986598799817978321526888251364313864",
"266312529744065787241276053337411286493",
"146357111671361486636941928665487591527",
"36967134721822888093314495098298002695",
"66239506392448446163199643802105469803",
"7784971953925114166535543609875150914",
"89142229221261318217315400692225509941",
"269504857759313817817006123482285540525",
"93566340398148660246244233818173882352",
"222623170673042806333859294535481680240",
"220579037321019819847433323499879743003",
"96569017927119155985917364123354853428",
"12077343128016188221505201335021473995",
"17874117843945282076901088794130879061",
"53815771563065287083528280097283950835",
"25795950609340699043749528203750438017",
"22452068729414625872431445704053308872",
"264391702473210744373835205566735177805",
"67319028342476331371836696396705947560",
"133137000248276652550133908628145491526",
"333526684137942039834881865831131271678",
"7278790929139474940970674716626131549",
"24889900390562809449738357440075664371",
"151275323965666630147994101081027619376",
"39362893866592204877267923914067883405",
"97878742917900239189874678120972465275",
"188628993063473740540284226722998056237",
"86509855906841907459879212939001931680",
"115190436806796306890075585173560627144",
"165181792841392315626465713908918316064",
"228800607729836071830082299031969506776",
"39677422781687119978070170390051536345",
"167279560195729704013547830913769769829",
"152454236742156975876165930906887209918",
"147043580899939894210050976218991638128",
"156595608358211742869950782408239694489",
"282567736122237524684369820792845587537",
"325191933176160686471375935306796309603",
"74910010094093160704907041058419372261",
"204222555071524359988401006658484608266",
"179732820271421051909442796014905293561",
"170163286510553036032853403852820145584",
"243433951627688500773492644100989282262",
"264328182842778423615753408733401330140",
"299910038628017455852546851398564504037",
"209148742379144853545111389719042942482",
"91312379097151058799358867666085243007",
"325373672020478642739894354778648717009",
"280276719164323978721389114842605507001",
"201187983270273966588306357464238339428",
"155358087280201890755808239979430078113",
"142569713024744296222896113757808620848",
"45769859023116560246005750556883785941",
"41638369315346205627464792600412094781",
"53839136140848764103007640374022397067",
"183650420722527210105806958022739741488",
"145267068143567589767624413707590659112",
"118814526325699277037903928131545628082",
"153066957943857855042731778558188069397",
"177905307048228908424995445890109760003",
"10783366070949384682735503250664022287",
"336877467891155623382572621927389909342",
"195705592079757760804692408546767101699",
"55822518294533911166647247799076015349",
"176044550798479187483687945981688014658",
"111099947349879150032951780263292810798",
"136994155686878917974856609711302551254",
"244954469475971343864012036409301122481",
"51207354447808069804001791055823726687",
"130677191477203567375007460082224334385",
"268263477722328425895950802552811535653",
"262459517294838060072425938240213849769",
"70681439278969723790391472474293057606",
"205408569841379230255524776734858979255",
"201013755122093576327675826436844929385",
"131214262543615759194778336865467888853",
"91348809756182015872697973761524950937",
"282078867236635453322411782331237206534",
"274490199099757251150003825945274479196",
"335884569034712398401233074925721870043",
"305103039348053372532418346531183806330",
"105181677386689232496842686298523345559",
"83066402548963908762727381571951711650",
"311295439829359551614017582555911775868",
"93669085962426844124414395051070853429",
"330076447642543249720713220789036169459",
"14773022933206796675671657868402819361",
"101867301085357441336998045574235047711",
"332027727111707698853605728409740173934",
"177054753966283763582763405433265736574",
"64681122683976770164434298398679693092",
"17533679626857229155244953552600151712",
"87963404321823092167912578329118690932",
"4813103574712250723249570121199578817",
"4642366036605901035065644860180580513",
"250383803956434854256215935856310004913",
"108743864750214756620873107796304637869",
"279585445613107105484519869162374410183",
"72743760623065867348261685021667217261",
"89540863803868072380221109729977929887",
"330640610957943882126555716026650511712",
"270156302767645291752856565328207068764",
"242076858025344806864188221789434022409",
"294885711225527806725323197329962386623",
"42792045884499019593544938037772426021",
"147294971906766487376664989202520906754",
"217713318319282869050190070322609127694",
"92526711598887728908148016501110720339",
"304181744577130535560323045835163251912",
"144701284140629942164128082304888000176",
"100293094495959895489122510652820472508",
"323544394158588100800756220723220958865",
"115132224324331350777719469882326666409",
"84619138711755417077987246243409828790",
"218069418090522565017626249174529096402",
"159886483151527445215270347797754781525",
"146748672655988864639965693614698447471",
"253954999541666936855604003365334635216",
"261199747214825259508305400158040306095",
"139821487897065238654089355341415311329",
"324798994292602267824579393237863459284",
"203151959899469583378527723644644027062",
"98205717432747836246369041970557890147",
"229716006334052101740913302067501872193",
"104721312102771758800812514113325340378",
"224609416049129116126967864776620822349",
"12943243519832185405786868127253439617",
"73585950145880198814493798268407204702",
"137865445235751633236171552917674387693",
"271574794913400679605466070055798313688",
"308172812689027456980535683553208878660",
"295162273045802166382414073596636406615",
"309213940758875951976295699379318832509",
"198401531983207721830311213498209611229",
"121924924648873759602127669013487960518",
"66846566605896123827410862686401594146",
"47414376201875727978874464376251910621",
"68953917600968531414522547256530449785",
"239827318150531256448313983681379936855",
"306535313124210758917517972247837391562",
"214553368144704424741001476866676465985",
"39878425058734573199165270597536821782",
"138428611929046711521053120307958417946",
"211844674833530448952496592712114240138",
"255752536632193457826002209336393524968",
"279266818088756082118054036186637312374",
"240723449606108222057614840487779895638",
"170321865176901310768386286383224951962",
"287217466539457265007485677400923452233",
"117944620333027672168464665919056957463",
"133672541684000864911561701422987225907",
"169578652136108544469114688321338411915",
"232722289391612431273746847307787862308",
"141623566115131207436213336041731717139",
"158953281748759266340311535225195753377",
"247545310332355634950523424793895241865",
"256031166907824725505675868670670193946",
"175451472058552380681832349658120298702",
"311853817027332538165949666617610374685",
"210075602284410885326522058685769769842",
"60611855017330224580402834734218432668",
"9980599857360341827656390788390787379",
"231999275028405833687027102534646001389",
"142050831682868481852872173397644130694",
"84602397229293040082963473499062574501",
"20044839823812444971018070863877563323",
"316880302287178944904210817435190397101",
"31381625958005611511984106705575912696",
"262443759203455179040137099302997356259",
"150400160677790616749698359487798688813",
"244954469475971343864012036409301122481",
"51207354447808069804001791055823726687",
"130677191477203567375007460082224334385",
"311254852902428493210922194403869355978",
"50641678491956388430669459301369733711",
"61032058149679852947039048648508479544",
"103896865687136473517224605150511916116",
"127069349589356876085750026465613421544",
"240531741282617778678685342179443407507",
"252500733419123092872206309005507477520",
"282174633951692694935644861167060714094",
"256222144323121675045462325472195140432",
"332800056510445252220138592325309883826",
"201000281456620890255743073835730135375",
"73448792958206143956252330939583664894",
"47176353029881125860654310317958497516",
"85372747092838731050922156243769360166",
"121934297317238510151917225339884288414",
"199298105113699324476053896271253502603",
"305987743424523562261007657803457073768",
"332578271373714082302212956233188922864",
"85707507323387417093407089894269608538",
"337592324610162072719630524034522878225",
"159689974555224326998337709383564665810",
"121513907770785743687851223489460755100",
"263159628520089204996303788199814620499",
"24409484163938948292187955015600394921",
"278613904276029818108668174005828547580",
"97884595408554837344506541894443757373",
"285350679185111641448137742064365471552",
"241502434436545744987312266869985312309",
"109710689759613991511969910226267196872",
"300867519403138190522378070153837175470",
"38835658996159747843644992736508841732",
"27045662792659533188942443270182024026",
"183039463253514650377086130288177473575",
"321194784265044540205519152422600134845",
"293339044627026037321889698530838545605",
"309469465924372382170323123652558728830",
"179141824868451923387307691835717477410",
"170412550012939119396004151907266468563",
"101124675321322893867524691947824090979",
"323574062305044712995599487469929389042",
"168318884170564438960982794231254975797",
"323440301328635725613795315600965836764",
"299726596619624175472177170654079512006",
"103602473114103233940339552133644646946",
"151937390199916471500148929821272697199",
"294630055719569287119928096722410764605",
"5502226411030999168235445391743488326",
"237709492713661591148180411370701622034",
"160133278329588836030174320291614338414",
"164718654193588210048379036283787202261",
"318895572596280030481064614850393009913",
"105625794678151220010534258613334995450",
"171525996394849744618964113579322380230",
"28500007487840808753764996202204105073",
"37913314730427890554295736872308630176",
"20044839823812444971018070863877563323",
"112370176656454721914196972022221983754",
"194175321644719232281296344994641747224",
"254548480648344507742284407009317805450",
"220482128268559328353186149755342039558",
"244954469475971343864012036409301122481",
"51207354447808069804001791055823726687",
"101166875340034922373679068479993992670",
"269571847900362035639565496342441286782",
"256418798296666476805774523518877346882",
"298158417507942678094945153766585626486",
"120068880184587282725795752136940334200",
"54594835993296654307154233195597820636",
"330021271704986368367677095315441829184",
"327599814664093022441121622943935828015",
"59925346647423663980449079522473199833",
"82014955853456024611679679230042144208",
"278851313065967910761543507547408743326",
"115527515220290075162049093175953044036",
"299989198126636714156573733993913650820",
"213294448556391906857212549049371118840",
"263490630095693096826642292626586181112",
"160932338480336451467214458696944705234",
"283343160667055899199023786862760564932",
"279157708660503809287547621970788259022",
"123873615476975422252434981599327651206",
"129971217962467019179352851103128044377",
"250860330502804214174889297849495263595",
"102991609843635818470666589976215778269",
"240439141911022783734723462339182003855",
"202793363743893409261533722492655177310",
"271260758948777432772676844137658802968",
"267328968362199913391922639184734777126",
"314211101114113787980272749055626582666",
"97823462999447590356384018325588751537",
"225059414089728934821641943056306574794",
"165656447396307127255012879512002251740",
"249444518914392357466445809253814116738",
"286370805183098641038874168999178020230",
"246075868780193452058329846339475971347",
"109149238658214821121866501083520185382",
"274931341182002200398361259043361759547",
"71325184346980902219690219148261818858",
"129650409936076786758414996147515633886",
"317112247475317423677204114707663642090",
"27325322738185611260507641270052145602",
"107367616447542941578344375942408356489",
"300285660087532293658850970628462145967",
"268525877141148429469970574849000991927",
"189996594200393738372673077925219949800",
"198213140105215730681094258231731008141",
"184891822533516727712958644434093510515",
"19115353557363731994099114811843220997",
"79038761637795964648805765684345734850",
"128902882149936870337443259295164129554",
"113154045203836963579078480808034953195",
"198005510842886782422650019253411643378",
"83025252632090895271332770877767562849",
"120371501915973592785746251187497332979",
"118218281528253075506652453330357264413",
"127878965039670256987559504659681007628",
"40740353398493749857007900453406908641",
"267578477909356861514821290887035650438",
"34927914197087881788088078890731522662",
"251775227450215534817841879640941313941",
"57232494692343689854104543868947024171",
"183727529212311678763692498860258903838",
"244954469475971343864012036409301122481",
"51207354447808069804001791055823726687",
"86767848422075335359413225569731942001",
"218227295552677576008203045492733065212",
"181095903386159448290570624820171551267",
"247179218533745690585811172098652110681",
"120068880184587282725795752136940334200",
"54594835993296654307154233195597820636",
"141740127682069790114423558259866347427",
"316477704010955582791322267447472523",
"63187048706843241941664312704972329502",
"247968551522391108429494611348297192651",
"337051593811661876732399081676016962409",
"34878928803165743265391420845882517438",
"277995848221432686838506278133683853410",
"11697017824122517087311617910018818265",
"218973881269231130299018435134027159939",
"291890510564415199901066656884758275753",
"210758876591073774373637978736578474032",
"200250527239761914752503027883368455615",
"198234706684508717326646012142435182877",
"145179882971737664293396103053855345808",
"302088318758086004303980729567805182263",
"325958811336871408534937354256787519345",
"215528460073270681988474005329853421100",
"92050363194379008319932619040311145023",
"321697439226928752220244461793485040215",
"93967477407491536014139659089900877581",
"332908346302057801599677609989440193264",
"213143731608568175293090316742832680895",
"159668234636506035822203788730689677752",
"75826647928562700912610823867490572908",
"205986135277467625627247402204720193256",
"45723750228661365955436513170165298531",
"323448533975498387628426159412470316726",
"213021129098521690134607008702886709159",
"47907468715511526757985276730406936165",
"8742179586968129572837138384556036183",
"199855370282367190374246106605072742162",
"222971332299295787777979166163175364402",
"254635959042353174675989575515586827270",
"265506005058041221804702476103586334755",
"183421148836723753134588461184455386817",
"301117810906050557115740490178976018228",
"105084891337191663657951510840326766864",
"40674431666562476286675121721485163297",
"113790696770605891502963318075319290470",
"245691042781036476862169140629532797868",
"27395674634681990617273440569123507913",
"278953334559146885535788550666968745228",
"322367842193352893875612712351154441176",
"21014515006348027796239962877917312830",
"219790578819783488096716877679405672491",
"107930120573370948897480655002596422010",
"149886160597502250043861526202244608644",
"148036457368111821778585073294136486950",
"224528795045493810492566285092713523832",
"334052103951686436988035459254573645324",
"225766021613965899100168511116564135288",
"319129894570896501388743948290796697213",
"218973881269231130299018435134027159939",
"33121296572145274103995940583706808197",
"62998673367360131483676562620107340098",
"198721445924901549000802421885288091100",
"11501235161902040700338411963139778564",
"145179882971737664293396103053855345808",
"302088318758086004303980729567805182263",
"325958811336871408534937354256787519345",
"215528460073270681988474005329853421100",
"92050363194379008319932619040311145023",
"321697439226928752220244461793485040215",
"14841650874400346314533127056584025038",
"6389100180337065466916732798938932817",
"129726055845924031829784213162046775191",
"75826647928562700912610823867490572908",
"205986135277467625627247402204720193256",
"45723750228661365955436513170165298531",
"323448533975498387628426159412470316726",
"213021129098521690134607008702886709159",
"103280974634964154794666297107354423802",
"87366154614562015281588872674017432256",
"13937320756365416524760558985041617565",
"254635959042353174675989575515586827270",
"265506005058041221804702476103586334755",
"183421148836723753134588461184455386817",
"301117810906050557115740490178976018228",
"105084891337191663657951510840326766864",
"40674431666562476286675121721485163297",
"113790696770605891502963318075319290470",
"245691042781036476862169140629532797868",
"186294236919754268091225382541678211864",
"172727081890626788097619426706411609985",
"15225791138747345981765862316754999915",
"88498486195521898516258563821153511330",
"104285521828250032552078967330504028631"
],
"threshold": 0.9
},
"id": "CVE-2026-111764-770d6980",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "295112548762344037205684050472038867249",
"length": 86
},
"id": "CVE-2026-111764-77206329",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java",
"function": "setUp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "146672581262999630180276534693899730926",
"length": 4639
},
"id": "CVE-2026-111764-77683c90",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandler.java",
"function": "onMessageSendStream"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"134542412522150502195737524598194807944",
"316694455432631527332777411897857536051",
"62121802151598125124284226606994175874",
"133545772649606002433008716427008977270",
"80288603016302501668258409629869121097",
"845601620902355335865735968979719536",
"115934399690897306279083562817156553545",
"37176532045082720997860611557784246250",
"68991067886758502176471363168469933823",
"317266623974799564217210043330688567578",
"42408286621928637630635045234222890694",
"15206666848596950482517395413471266442",
"7621928188304765086842621013840338021",
"56647045488108168832979370486690243539",
"90207215609165971998057983452670146388",
"320078416530803022831907512723262137139",
"100936658618934162589025563092840089946",
"208429196206103023594121326837244258374",
"54314468942446664812771345895229187137",
"20027287559778260854185583877654971876",
"161128967993510755485881147408928043617",
"175760619789812078722531436380413541459",
"186916211733508522936955787640864147953",
"247495429158068846701542830978847686791",
"113658252081654445371127496008399109503",
"1541403363241432075573203445744411354",
"131568390667550624260121331260002619533",
"181689949943980733237124319054497199482",
"209602447906666079555324836987867097858",
"146855066048036114300668573112695181640",
"116315960458860756621095012821752379243",
"275842809338723367741300956347932687266",
"304901692165134117377794068157753780487",
"66880829218055445914218434569343068168",
"74176465901074524784882560496724350323",
"276531683704891506374027406245005749901",
"291096142534127140505834936911587582665",
"207203445166187413518175014896030766524",
"87031599313485774694296277477281921498",
"130077023329823754187648424297094370542",
"41552268222527176977231321916775512602",
"243515629643180879520030337730835703058",
"199160752800201333368735429595589310117",
"261201957631202554363082715628079337043",
"210402762185789363508554318142211840051",
"208446736317636256807821465570665453532",
"289888299188538280720830704940204900853",
"329369760953054835593161628606090795231",
"113457645851070405214872384811845646721",
"224189874227847327480640975466276852429",
"5004363053094713264500536384185496641",
"331174352471454599560832454276944424521",
"114522162512470809799099133072033738394",
"92008168823939845807142562289179328625",
"129813416237805577696379506143387832483",
"31366648532587416280722132277685810407",
"198579038188878961675832546320151532934",
"99317997183139191752805752796674086431",
"91038025824534107071110004796254022184",
"298251947251747506899482456692819493817",
"176018884956199393801133714846413359514",
"167666732808677217936298533917415721325",
"91311219511527969400436962202625002929",
"108862487121585577644015783082674271474",
"17366038062803439927727784395089140281",
"2476020911532084211432743188452946592",
"312487165880855959062548407176565433504",
"230578380794189858402893656683014108175",
"62906804795461899794799485964801218177",
"32906752219330873043107529072485457180",
"145432030102155500913163855954375314011",
"44602347814453755811529801387525924858",
"76915589764228432755414357965517931144",
"32906752219330873043107529072485457180",
"132417835351897233163065219527771570394",
"252488290029614448102858473623228365410",
"252893499027043483758963213590400642331",
"17740604274391580651075857988070405041",
"278602396136058905210990529713380021407",
"223142369504171982851538435597449609063",
"277872245475356422284353602655283331442",
"147413164550179066382687536769653536521",
"335996708451579664960387111024022218165",
"77268425917882310076343917388082078286",
"332742210932691936766362712696473605264",
"117405841355789088345959612655546661883",
"44602347814453755811529801387525924858",
"76915589764228432755414357965517931144",
"32906752219330873043107529072485457180",
"205039026209417725877214827399518554840",
"295490958208262672363068743228370982021",
"42026188127085601788540457072206700996",
"243591747424284492541333372680567021560",
"67975106393269576603810409550165729709",
"91099339922819346447165154496403066278",
"187197975981534010194616104999181798143",
"256324651976279361762064955949309880581"
],
"threshold": 0.9
},
"id": "CVE-2026-111764-77bb1741",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandler.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "45346085740744142419997094926210199372",
"length": 186
},
"id": "CVE-2026-111764-78d333aa",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java",
"function": "enforceCreate"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "132915072026427104205069609097683987477",
"length": 94
},
"id": "CVE-2026-111764-79162f4d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java",
"function": "onComplete"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "201506284203070150503073453751986099690",
"length": 282
},
"id": "CVE-2026-111764-797e5b48",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java",
"function": "onListTasks_denied"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "67414018469129253072782982950867588139",
"length": 491
},
"id": "CVE-2026-111764-7a46d835",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandler.java",
"function": "authorizeTaskAccess"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "264679655284508079360377133725483710794",
"length": 99
},
"id": "CVE-2026-111764-7cd14ce8",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java",
"function": "request"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "149706368532152370275710620816668170143",
"length": 322
},
"id": "CVE-2026-111764-7dc3d030",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java",
"function": "onListTaskPushNotificationConfigs_denied"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "225591017764446987172353849909639489662",
"length": 266
},
"id": "CVE-2026-111764-81889ac9",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java",
"function": "onCreateTaskPushNotificationConfig"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "249050328863636482625193424220515597611",
"length": 487
},
"id": "CVE-2026-111764-853077b6",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java",
"function": "authorizeTaskAccess_allowed"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "142143994974781773389992370357784378415",
"length": 488
},
"id": "CVE-2026-111764-8645bbd1",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandler.java",
"function": "onGetTaskPushNotificationConfig"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "79524788185103193583617175831632792864",
"length": 497
},
"id": "CVE-2026-111764-8afd57d4",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java",
"function": "onMessageSendStream_existingTask_denied"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "232465855232223667101245226499058560967",
"length": 587
},
"id": "CVE-2026-111764-8b6050e6",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "transport/grpc/src/test/java/org/a2aproject/sdk/transport/grpc/handler/GrpcHandlerTest.java",
"function": "testOnSetPushNotificationNoPushNotifierConfig"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "239109157508782639446036813810723255783",
"length": 6520
},
"id": "CVE-2026-111764-8d63f1ea",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandler.java",
"function": "onMessageSend"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "204632667232011251896992680640257057232",
"length": 185
},
"id": "CVE-2026-111764-91aeae7c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java",
"function": "onCancelTask"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"103279946963212335911736350649574221673",
"121837123797240705919810699090603641497",
"222296640959646423735949629053496502751",
"160218622437418651815672663324536949428",
"103279946963212335911736350649574221673",
"121837123797240705919810699090603641497",
"222296640959646423735949629053496502751",
"160218622437418651815672663324536949428",
"103279946963212335911736350649574221673",
"121837123797240705919810699090603641497",
"86311371136133631619339927911801564259",
"77636774985600908010545206207114136086",
"103279946963212335911736350649574221673",
"121837123797240705919810699090603641497",
"86311371136133631619339927911801564259",
"86439659264132408472115624424798606826"
],
"threshold": 0.9
},
"id": "CVE-2026-111764-942f5aaf",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "transport/grpc/src/test/java/org/a2aproject/sdk/transport/grpc/handler/GrpcHandlerTest.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "321743928332309153873753592215100901254",
"length": 112
},
"id": "CVE-2026-111764-945d8c00",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java",
"function": "onError"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "5895879542972646729770085715946447309",
"length": 98
},
"id": "CVE-2026-111764-959bc3e0",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java",
"function": "onSubscribe"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "245792905636354405431029398407424647176",
"length": 205
},
"id": "CVE-2026-111764-9d315d3e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandlerReferenceTaskAuthorizationTest.java",
"function": "nonOwnerCannotValidateTask"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "6114597776505991297644363081600886124",
"length": 393
},
"id": "CVE-2026-111764-a507a00f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java",
"function": "onGetTask_allowed"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"21249739951356109748777978643101539661",
"220510949941847913076942868745477166301",
"250937929953959254133352442075708144252",
"332359917435630157601934604563873207530",
"219906243090644838576645730335326094963",
"225264602821574728347996824084356073158",
"230651671565673394387448117847314617888",
"14077858815784415935861465374183833680",
"205172075148607436727599054046980642763",
"217294056582144500666822513457195451672",
"210969532623685863478168399958005260879",
"309061689243852132061102597115968628978",
"53368816913996705677594699343040003720",
"140544179526617541082207204443917399829",
"99816378316581279066896424446588888380",
"144371398528534365038250029926863512905",
"167946256896536799300310886328062245494",
"111755238725875773403026804765118566",
"273334435558845482840412405109811086631",
"112915263704388491432775176980790167647",
"37148794281772378289287838738032122618",
"134542412522150502195737524598194807944",
"67289335453023252204303035130493032248",
"253049586750895757167126474947204780673",
"97826899102751551349675574014924289422",
"324513891160176116505305394782937440929",
"335603100078381088969046483157270095428",
"317548438476110730734334288363324004499",
"204976085260816609058848932084318304249",
"102398673095839568491931103005268708254",
"48576994511803670679129739362274598590",
"191894678589208679346654131436545316992",
"295175426398561733827865034688960116827",
"203012827551274490416446674202339967889",
"147573997505528615225334951470248132775",
"131280598717052801222014744237725298814",
"46715295129681513517058229207879341536",
"118215402612740708525550147659025970493",
"318235791065666307189279771207805112205",
"286696307512151731428487093214376181689",
"226886309666382882673457805072187640415",
"211082099070559825521499321238964353575",
"132850339791041584559778739536300817075",
"108743465796072752223245144763264108442",
"129342800700638986670549074954860625121",
"317963164228910999534066575940287420909",
"335159035923752769837482784695832056384",
"285624357305031209079335808904065491982",
"227614985951737115565375716740020090253",
"153658674067328727875127093470653395857",
"116017217731968091066038469488819266415",
"14837867832569210537389316939555094380",
"219816601242118250332093768536237264297",
"247074094294906536438307901872571846023",
"106604658351561153728311458183024188310",
"6897112215502185203348938835737281759",
"10874179612997808622048388264401694013",
"262435837527409946189589459065224037944",
"253655376828275421602365250849412229527",
"88395180928418609523333742725479858967",
"194980035509159043447635334646267650100",
"191441601008887768978985625692373901496",
"199702620970664342468887356746522248555",
"187840481180794607977183271705991888137",
"83351901734704420264924545794292535048",
"168460089253442692187446243785053857529",
"1269135536571574111632447344240648204",
"212264262838916069737425824762580906286",
"273403763038312467854391708768027746295",
"49319763837879104140979868521474204580",
"128377695955396377787468260077010204950",
"105505453776399435661055000109808863084",
"207884461912050501482402578335766198979",
"205958651467223404932270650106601120856",
"234164390339318044275416272610538159240",
"127292681729051476107999836063349665795",
"146067010255551275588107458415822210652",
"312743871745538546704417037702389625855",
"167561716316963234172957355499905685182",
"91762633863806303951639719798291380155",
"200730474657121033542814426416964329123",
"154453074583207496820928833155564934228",
"211667678489014249346125712522739857480",
"3775373242849942455016633235539813711",
"116565369856929850073553543761510753677",
"117647536085001249830278575766323799675",
"114572924349424572700331116933039268673",
"303305823452925783651143056398558317274",
"293949540968280903538352693917672011553",
"279288379845982762458357164965023444659",
"322350395445813700063512663967888293317",
"310199675831189992499601104530634353621",
"100579232952590662429392058447073969638",
"81437804977260098146033706092288363505",
"251862622697637882809936678679988252159",
"102308574431314701574317595489977405220",
"65019420622916991544773030129787393153",
"329938954978422613902502309404735067281",
"268546951903598787160553103843484848314",
"129285467053641858151009822605605999670",
"252704042590733162671592719731756045848",
"292009960049003980558802571304262045098",
"97880747020471980709514273472453922731",
"169403800564834274409462374298381128037",
"79857656579781679713873665099933085318",
"157986713923486832780766759971462656381",
"333789507658108186739000789380062171304",
"49369628945849007144890648624151057834",
"214231438498254070563663924527890044281",
"80491073414208779645887022274968860631",
"237402788195874293839658639210421055257",
"133209009892605882632020554236876352494",
"287801074852189186867683498055118833333",
"271856953372832078986854765969155776358",
"132788812436328379899614306118895050430",
"154095472091491765129707014423615926251",
"98615232725614586023632120173621575601",
"182630661747757929167846290487974373366",
"235646780049931381624650606273200707462",
"24813511160132846875972758709520898695",
"311569316698243565441212413698982596710",
"334445088530249943130571286135775890417",
"282056646868755043841115199289324400626",
"90530465303796215476980710112486440445",
"237831593872139477803271808390989103706",
"259396605515056085945913259688776489024",
"241892045113307103081062599329819499838",
"155321390330505811726203394966755566233",
"13680828682964174770112691193444811728",
"13185270604142172743593531921937743052",
"308825821932500317790363416395638181091",
"335739877842835889678655825766000724462",
"336460453726753208299788674314205226072",
"126318162438161210896102569555840701449",
"110922659666884908264684850319441072611",
"184479364968401682795940882733287618190",
"176512513899240816579949673816071248044",
"294962032552106531244430711491725879307",
"190398769208255773485784819093843208848",
"257613275441602757188720414959847921174",
"163147354067655261538630886636550895079",
"49805266219869040674650489713381921904",
"3347649074318008175543219192633576771",
"238059121100136959489819310620297186256",
"161393056079792388419228814523630469536",
"72848014638274663840899572135817598633",
"51929646506172722846640496855724284153",
"217243911474088897295669316019695608172",
"189925646165518559536677310106317198223",
"142334101749323504684161921099353382220",
"85586202517259122684573253131365598842",
"16317998009788608957870472680700476398",
"232084013962780015096753888752440309005",
"90425704415337628069099901975854519376",
"266243953512657868635929918931206435174",
"3938463669314619163702884888651103788",
"317277846786753583543280115315742701494",
"190489408618144925846894311136756669881",
"237811729778302425667674066381472129311",
"213535528516739210337143501180438033489",
"273351791535830955985324925058883629205",
"256316472411827081285614842848108587687",
"8938172989787298437369389398404360723",
"305855384630754245147008252443428010138",
"218949187573147107582539635176024172755",
"300224618740373093620536405150692692406",
"176601037240412640043121382623672311747",
"140345602879051231997666445365063821531",
"39012392481502407786233652196212898723",
"42750724670036026378498041289802318235",
"132192668290132982030653435875326173996",
"198296893782585640287971537757780675013",
"291021252346753513477032843975283905848",
"321664958341191332917298728592819352437",
"104939712921120974220966957735318004222",
"98669852203680654601748974556493271943",
"325176299288776385072806328701576129754",
"163448463352363392543862005638033235011",
"100028427385538634487212275871620188921",
"117770744428413342227480703109006444137",
"204777026927678435987850341624974342121",
"194916949033967715587847125153840363427",
"227351489116010371611149607134591425814",
"281071257010839163652863055522752901408",
"63882170517993553849834264526854488650",
"209219312955328623662024154153219010816",
"318539691888347876179584412449319949200",
"121013087809681047896159752406249995551",
"194177213050783946858156787507144265796",
"180885175345096395549476416564323801708",
"156876498125598790879882759224508343214",
"218612256305483314148083522664370306747",
"246569769536308220880715337729906440133",
"303706056147899902402517124105606500902",
"9928626218528132949700107492242325522",
"21583899751625506186169830319493659772",
"231674138868417394463798343679526529103",
"201269625956540909835345072601577811840",
"243480397436456933402859593089575204885",
"188195572386150773047363401147665464073",
"338954564177479419876439785405513178962",
"220867572358988896233416347076645464277",
"146262015903400122319179919151677586865",
"119466361322468922577108609620400671277",
"87980751220737707311792955658256330273",
"285998651550793837909203176382650874176",
"133119363548594665751803017121260027075",
"213277614197307453138149900283084279623",
"83874874260525357052197355971288959333",
"99464141688233317772113786795349380872",
"109676312557668628177226103727296854927",
"138980789119556060318848718192616246208",
"56665186118514205498063880493192139751",
"25996996240365921786503688957807605916",
"337687722089380891655040126651902517525",
"220377367584202123264835352743133216837",
"37199256582145742739855874602880577650",
"77377777959540841458204822867651326929",
"107360197163420055338868803742020626745",
"288171379196214739275962479821728559971",
"268135858630777240567227615290590917282",
"1498144344550885716417743132521408990",
"51669414012635440211322239358646239539",
"316868344074496922743937348782053436681",
"270689332168735094205691269177526544083",
"230880247362843604981397683466918379462",
"257624234144880799237743999063505413178",
"75528888424960434745003569381289774118",
"297081909599768605970801371391608534057",
"45606776725044434982378949018466848705"
],
"threshold": 0.9
},
"id": "CVE-2026-111764-a7479c89",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"103279946963212335911736350649574221673",
"121837123797240705919810699090603641497",
"307356680253461755356971394650760614219",
"172061619516007398967195203699972366878",
"103279946963212335911736350649574221673",
"121837123797240705919810699090603641497",
"307356680253461755356971394650760614219",
"172061619516007398967195203699972366878",
"103279946963212335911736350649574221673",
"121837123797240705919810699090603641497",
"307356680253461755356971394650760614219",
"172061619516007398967195203699972366878",
"103279946963212335911736350649574221673",
"121837123797240705919810699090603641497",
"237458822856413424652168865184252337956",
"122903687223352327588496848154751138436",
"69987723212909969162060944687767062621",
"121837123797240705919810699090603641497",
"237458822856413424652168865184252337956",
"122903687223352327588496848154751138436"
],
"threshold": 0.9
},
"id": "CVE-2026-111764-a7f66efc",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "transport/jsonrpc/src/test/java/org/a2aproject/sdk/transport/jsonrpc/handler/JSONRPCHandlerTest.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "107668505648553541635564416099774898785",
"length": 243
},
"id": "CVE-2026-111764-a841138c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java",
"function": "authorizeTaskAccess_nullTaskId_skipsAuthCheck"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "148006350406143876540249428600930445758",
"length": 547
},
"id": "CVE-2026-111764-aa8f764d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java",
"function": "onListTasks_allowed"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "82713073675528765716973745725122351737",
"length": 333
},
"id": "CVE-2026-111764-ab2aac21",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java",
"function": "onGetTaskPushNotificationConfig_denied"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "88310155033090208086303290054449575320",
"length": 1113
},
"id": "CVE-2026-111764-abaaa14e",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandler.java",
"function": "onListTasks"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"111778023965639062848900596886964949329",
"126010394243428478581590943868493758640",
"161682440659051478667279994203891259253",
"9043863290661722052388714258054026568"
],
"threshold": 0.9
},
"id": "CVE-2026-111764-aeeb7757",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AbstractA2ARequestHandlerTest.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "250976677736741788770738324277876858936",
"length": 382
},
"id": "CVE-2026-111764-b03ddfc2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java",
"function": "onCancelTask_allowed"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "90811405098649080916284862014387937266",
"length": 446
},
"id": "CVE-2026-111764-b48f4fbf",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandler.java",
"function": "onCreateTaskPushNotificationConfig"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "157981654654093971214139823750310300024",
"length": 284
},
"id": "CVE-2026-111764-b5b0cca2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandlerTest.java",
"function": "buildHandlerWithRouter"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "279046309612686442248205898473986685863",
"length": 1180
},
"id": "CVE-2026-111764-b7b18c03",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java",
"function": "wrapPublisherForOwnership"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "4373080591595171220886826005876476777",
"length": 16
},
"id": "CVE-2026-111764-ba38505f",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java",
"function": "AuthorizationRequestHandlerDecorator"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "299698727802529302109099947845799474645",
"length": 1382
},
"id": "CVE-2026-111764-be812cd2",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandler.java",
"function": "onSubscribeToTask"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "76776203678447880805438801694339191934",
"length": 221
},
"id": "CVE-2026-111764-bf1cd5fb",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java",
"function": "newTaskStreamParams"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "105681889307527237827305705544418774259",
"length": 207
},
"id": "CVE-2026-111764-bfab2165",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java",
"function": "onGetTaskPushNotificationConfig"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "172313772274446370165053271207568154429",
"length": 99
},
"id": "CVE-2026-111764-c2515c98",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java",
"function": "AuthorizationRequestHandlerDecorator"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "62038868468793987852513752363301173191",
"length": 1150
},
"id": "CVE-2026-111764-c6e6a1d0",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandlerReferenceTaskAuthorizationTest.java",
"function": "noAuthorizationProvider_loadsAllReferencedTasks"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "45831894159921199296539858027081203028",
"length": 253
},
"id": "CVE-2026-111764-c9349b44",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java",
"function": "authorizeTaskAccess_delegatesWithoutChecks"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "328508516179109845977432004530396054161",
"length": 426
},
"id": "CVE-2026-111764-cd0f7668",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java",
"function": "spiException_propagates"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "209588267696387828362817036251153735956",
"length": 182
},
"id": "CVE-2026-111764-cf0d4567",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java",
"function": "onGetTask"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "154780070706653037848171980682357292012",
"length": 486
},
"id": "CVE-2026-111764-cf7ef749",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java",
"function": "onMessageSendStream"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "295112548762344037205684050472038867249",
"length": 86
},
"id": "CVE-2026-111764-d434ed0a",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java",
"function": "setUp"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "100427201312317086844894473198871905837",
"length": 260
},
"id": "CVE-2026-111764-da0bb0a8",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java",
"function": "onMessageSend_newTask_checkCreateDenied"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "127841236604642741744498091531434111032",
"length": 947
},
"id": "CVE-2026-111764-e2ae02ac",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "transport/jsonrpc/src/test/java/org/a2aproject/sdk/transport/jsonrpc/handler/JSONRPCHandlerTest.java",
"function": "testOnMessageSendErrorHandling"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "177754495910334437063074623431135036169",
"length": 298
},
"id": "CVE-2026-111764-e371c84b",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java",
"function": "onCancelTask_denied"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "93592506330784967556557057983696142809",
"length": 651
},
"id": "CVE-2026-111764-e3e6e392",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "transport/grpc/src/test/java/org/a2aproject/sdk/transport/grpc/handler/GrpcHandlerTest.java",
"function": "testDeletePushNotificationConfigNoPushConfigStore"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "131949576861847668730032781009992940099",
"length": 314
},
"id": "CVE-2026-111764-e938e927",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java",
"function": "onCancelTask_delegatesWithoutChecks"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "309501286259712398468642771101400238699",
"length": 439
},
"id": "CVE-2026-111764-eae93c6d",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandler.java",
"function": "onGetTask"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "333822587271517295595948056828116075415",
"length": 451
},
"id": "CVE-2026-111764-ee42a4a1",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java",
"function": "authorizeTaskAccess_passesOperationToEnforceRead"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "75656166713293216090462492719875182455",
"length": 328
},
"id": "CVE-2026-111764-ee7130b6",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java",
"function": "onGetTask_delegatesWithoutChecks"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "115793674088279809139726039614292361922",
"length": 304
},
"id": "CVE-2026-111764-f1372367",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java",
"function": "onSubscribeToTask_denied"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "95446882200850076094713837642863117761",
"length": 90
},
"id": "CVE-2026-111764-f17203ec",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/DefaultRequestHandlerReferenceTaskAuthorizationTest.java",
"function": "setUpDecorated"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "214124598442259282140938186846719028104",
"length": 765
},
"id": "CVE-2026-111764-f30c63ec",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "transport/jsonrpc/src/test/java/org/a2aproject/sdk/transport/jsonrpc/handler/JSONRPCHandlerTest.java",
"function": "testListPushNotificationConfigNoPushConfigStore"
}
},
{
"deprecated": false,
"digest": {
"line_hashes": [
"292276278457134277962993050697322686529",
"126010394243428478581590943868493758640",
"142101920190865847964587603273466477584",
"204538505019821762422170572494201788181",
"292276278457134277962993050697322686529",
"126010394243428478581590943868493758640",
"142101920190865847964587603273466477584",
"204538505019821762422170572494201788181",
"292276278457134277962993050697322686529",
"126010394243428478581590943868493758640",
"142101920190865847964587603273466477584",
"327373870755576298563183646234814947478"
],
"threshold": 0.9
},
"id": "CVE-2026-111764-f5866a97",
"signature_type": "Line",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "compat-0.3/transport/jsonrpc/src/test/java/org/a2aproject/sdk/compat03/transport/jsonrpc/handler/JSONRPCHandler_v0_3_Test.java"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "81098258928253719108281351358074452603",
"length": 425
},
"id": "CVE-2026-111764-f5c06c8c",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java",
"function": "onMessageSend"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "76776203678447880805438801694339191934",
"length": 221
},
"id": "CVE-2026-111764-f7d2e8df",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java",
"function": "newTaskParams"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "143324341584682871864078827762110949200",
"length": 308
},
"id": "CVE-2026-111764-fb50cbe5",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java",
"function": "authorizeTaskAccess_denied"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "74998893333959063359079389435066499935",
"length": 1081
},
"id": "CVE-2026-111764-fd840edd",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AbstractA2ARequestHandlerTest.java",
"function": "init"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "326647941171474878292541399020744639998",
"length": 528
},
"id": "CVE-2026-111764-fd9daf49",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "server-common/src/test/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecoratorTest.java",
"function": "onMessageSend_newTask_alreadyRecorded_skipsOwnership"
}
},
{
"deprecated": false,
"digest": {
"function_hash": "192365252993608256984970087448042814979",
"length": 776
},
"id": "CVE-2026-111764-feb52f04",
"signature_type": "Function",
"signature_version": "v1",
"source": "https://github.com/a2aproject/a2a-java/commit/efb4e985e99390c4fc1f78c0a187a4254c0a2553",
"target": {
"file": "compat-0.3/transport/jsonrpc/src/test/java/org/a2aproject/sdk/compat03/transport/jsonrpc/handler/JSONRPCHandler_v0_3_Test.java",
"function": "testOnGetPushNotificationNoPushNotifierConfig"
}
}
]
vanir_signatures_modified
"2026-10-21T09:36:46Z"