---
id: CVE-2026-113704
title: >-
  a2aproject a2a-rs Push Notification push_notification_sender.rs HttpPushSender
  server-side request forgery
summary: >-
  A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects
  the function HttpPushSender of the file
  crates/server/src/push_notification_sender.rs of the component Push
  Notification Handler. Such manipulation of the argu…
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C'
cvssSource: cna
cwe:
  - CWE-918
vendor: a2aproject
product: a2a-rs
affected:
  - a2a-rs 0.4.0
  - a2a-rs 0.4.1
  - a2a-rs 0.4.2
  - a2a-rs 0.4.3
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T22:00:25.887Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-113704'
references:
  - url: 'https://vuldb.com/vuln/422865'
    label: >-
      VDB-422865 | a2aproject a2a-rs Push Notification
      push_notification_sender.rs HttpPushSender server-side request forgery
  - url: 'https://vuldb.com/vuln/422865/cti'
    label: 'VDB-422865 | CTI Indicators (IOB, IOC, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-113704'
    label: CVE-2026-113704 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1014883'
    label: 'Submit #1014883 | a2aproject a2a-rs a2a-server-lf ≤ 0.4.3 SSRF'
  - url: 'https://github.com/a2aproject/a2a-rs/pull/124'
  - url: >-
      https://github.com/a2aproject/a2a-rs/commit/2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224
  - url: 'https://github.com/a2aproject/a2a-rs/'
tags:
  - cve.org
ingestedAt: '2026-10-20T22:23:33.691Z'
---

## Overview

A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file crates/server/src/push_notification_sender.rs of the component Push Notification Handler. Such manipulation of the argument TaskPushNotificationConfig leads to server-side request forgery. The attack may be launched remotely. The name of the patch is 2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224. Applying a patch is advised to resolve this issue.

## Affected

- `a2a-rs 0.4.0`
- `a2a-rs 0.4.1`
- `a2a-rs 0.4.2`
- `a2a-rs 0.4.3`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.