Maven/org.a2aproject.sdk:a2a-java-sdk-transport-rest CVE-2026-111762: medium 5.7, EPSS 0.17%

A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure

Action: Upgrade org.a2aproject.sdk:a2a-java-sdk-transport-rest to 1.3.0.Final or later.

Affected

Fixed versions

Sources

• osv: GHSA-x32g-jvvm-4725
• nvd: CVE-2026-111762
• https://github.com/a2aproject/a2a-java/security/advisories/GHSA-x32g-jvvm-4725
• https://github.com/a2aproject/a2a-java/commit/88827105fee0daaac0d883a4a68eb644571d7230
• https://github.com/a2aproject/a2a-java
• https://github.com/a2aproject/a2a-java/releases/tag/v1.3.0.Final

CVE-2026-111762 · published 2026-10-20T21:08:33Z · modified 2026-10-20T21:15:04.056033613Z · JSON