{"action":"Upgrade org.a2aproject.sdk:a2a-java-sdk-transport-rest to 1.3.0.Final or later.","affected":[{"fixed":"1.3.0.Final","introduced":"0"}],"component":"org.a2aproject.sdk:a2a-java-sdk-transport-rest","cve_ids":["CVE-2026-111762"],"ecosystem":"Maven","epss":0.00174,"exploited":false,"fixed_versions":["1.3.0.Final"],"ghsa_id":"GHSA-x32g-jvvm-4725","id":"tcs_01M5N9HJKN1TEG6K9A4RPVJNZH","modified_at":"2026-10-20T21:15:04.056033613Z","published_at":"2026-10-20T21:08:33Z","references":["https://osv.dev/vulnerability/GHSA-x32g-jvvm-4725","https://github.com/a2aproject/a2a-java/security/advisories/GHSA-x32g-jvvm-4725","https://nvd.nist.gov/vuln/detail/CVE-2026-111762","https://github.com/a2aproject/a2a-java/commit/88827105fee0daaac0d883a4a68eb644571d7230","https://github.com/a2aproject/a2a-java","https://github.com/a2aproject/a2a-java/releases/tag/v1.3.0.Final"],"severity":{"label":"medium","score":5.7},"sources":[{"source":"osv","source_id":"GHSA-x32g-jvvm-4725","url":"https://osv.dev/vulnerability/GHSA-x32g-jvvm-4725"},{"source":"nvd","source_id":"CVE-2026-111762","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111762"}],"summary":"A2A Java SDK: Push notification credentials logged in cleartext on protobuf parse failure"}