Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
--- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common (push-notification delivery) - Affected versions: <= 1.2.0.Final (and 1.2.1.Final-SNAPSHOT on main prior to the fix) - Patched version: (the release that carries the fix) - CWE: CWE-918 (Server-Side Request Forgery) - Severity: High - CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N (5.8, Moderate) --- Summary An unauthenticated attacker can coerce the a2a-java server into issuing HTTP requests to arbitrary internal and cloud-metadata endpoints from the server's own network position — a Server-Side Request Forgery reachable in the default deployment with no credentials, no user interaction, and a single request. The behaviour is the shipped default, not a misconfiguration. Details BasePushNotificationSender (in server-common) POSTs task data to the URL stored on a task's TaskPushNotificationConfig with no validation of the destination: no block on loopback, RFC1918, link-local…
Recommended action: Upgrade to 1.3.0.Final or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Draft text for GHSA-qw47-mcm5-934w. The body below drops into the GitHub advisory description field; the metadata block maps to the form fields. Set the patched version at release; publish when the fix ships. --- - Ecosystem: Maven - Affected package: org.a2aproject.sdk:a2a-java-sdk-server-common (task store / authorization) - Affected versions: <= 1.2.0.Final (and 1.2.1.Final-SNAPSHOT on main prior to the fix) - Patched version: (the release that carries the fix, e.g. 1.2.1.Final) - CWE: CWE-1188 (Insecure Default Initialization), CWE-862 (Missing Authorization) - Severity: High - CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (7.5, High) --- Details The default task store performs no authorization on task reads. InMemoryTaskStore's no-arg constructor sets authorizationProvider = null, and InMemoryTaskStore.get(String taskId) is a bare map lookup with no authorization check regardless of provider: Authorization is enforced only when the application both supplies a…
Recommended action: Upgrade to 1.3.0.Final or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.