Medium
github
·
GHSA-q78c-5jjq-57g8
A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery
Published Oct 20, 2026
CVSS 5.8
- Ecosystem: Maven
- Affected package:
org.a2aproject.sdk:a2a-java-sdk-server-common(push-notification delivery) - Affected versions: `
Affected AI Products
a2a