{"action":"Upgrade org.a2aproject.sdk:a2a-java-sdk-server-common to 1.3.0.Final or later.","affected":[{"fixed":"1.3.0.Final","introduced":"0"}],"component":"org.a2aproject.sdk:a2a-java-sdk-server-common","cve_ids":["CVE-2026-111761"],"ecosystem":"Maven","epss":0.00586,"exploited":false,"fixed_versions":["1.3.0.Final"],"ghsa_id":"GHSA-q78c-5jjq-57g8","id":"tcs_01M5N98YVFFMRTHTMY8VQ8P1KY","modified_at":"2026-10-20T21:15:04.059690010Z","published_at":"2026-10-20T21:06:22Z","references":["https://osv.dev/vulnerability/GHSA-q78c-5jjq-57g8","https://github.com/a2aproject/a2a-java/security/advisories/GHSA-q78c-5jjq-57g8","https://nvd.nist.gov/vuln/detail/CVE-2026-111761","https://github.com/a2aproject/a2a-java/pull/1096","https://github.com/a2aproject/a2a-java/commit/b855b2ae37e4bf23f73e7746ce166fbc5a0b8b5b","https://github.com/a2aproject/a2a-java","https://github.com/a2aproject/a2a-java/releases/tag/v1.3.0.Final"],"severity":{"label":"medium","score":5.8},"sources":[{"source":"osv","source_id":"GHSA-q78c-5jjq-57g8","url":"https://osv.dev/vulnerability/GHSA-q78c-5jjq-57g8"}],"summary":"A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery"}