CVE-2026-113704
Published:October 20, 2026
Updated:October 21, 2026
A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file crates/server/src/push_notification_sender.rs of the component Push Notification Handler. Such manipulation of the argument TaskPushNotificationConfig leads to server-side request forgery. The attack may be launched remotely. The name of the patch is 2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224. Applying a patch is advised to resolve this issue.
Affected Packages
https://github.com/a2aproject/a2a-rs.git (GITHUB):
Affected version(s) >=a2a-server-lf-v0.2.6 <a2a-server-lf-v0.4.4Fix Suggestion:
Update to version a2a-server-lf-v0.4.4a2a-server-lf (RUST):
Affected version(s) >=0.2.6 <0.4.4Fix Suggestion:
Update to version 0.4.4Related Resources (7)
Do you need more information?
Contact UsCVSS v4
Base Score:
6.9
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
LOW
Vulnerable System Integrity
LOW
Vulnerable System Availability
LOW
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
Exploit Maturity
NOT DEFINED
CVSS v3
Base Score:
7.3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
LOW
Integrity
LOW
Availability
LOW
Exploit Maturity
NOT DEFINED
Weakness Type (CWE)
Server-Side Request Forgery (SSRF)