CVE-2026-113704High· 7.3▾ TwilightA vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file crates/server/src/push_notification_sender.rs of the component Push Notification Handler. Such manipulation of the argu…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 40.2 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file crates/server/src/push_notification_sender.rs of the component Push Notification Handler. Such manipulation of the argument TaskPushNotificationConfig leads to server-side request forgery. The attack may be launched remotely. The name of the patch is 2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224. Applying a patch is advised to resolve this issue.
a2a-rs 0.4.0a2a-rs 0.4.1a2a-rs 0.4.2a2a-rs 0.4.3Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-113707Medium· 5.4a2aproject a2a-rs inmemory.rs update race condition
CVE-2026-113705Medium· 5.3a2aproject a2a-rs error.rs information exposure
CVE-2026-113706Low· 3.5a2aproject a2a-rs inmemory.rs information disclosure
CVE-2026-111761Medium· 5.8A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery
CVE-2026-90790Medium· 6.3A security vulnerability has been detected in a2aproject a2a-python up to 1.1.3
CVE-2025-68616High· 7.5WeasyPrint helps web developers to create PDF documents