Description
A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file crates/server/src/push_notification_sender.rs of the component Push Notification Handler. Such manipulation of the argument TaskPushNotificationConfig leads to server-side request forgery. The attack may be launched remotely. The name of the patch is 2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224. Applying a patch is advised to resolve this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| a2aproject | a2a-rs | 0.4.0, 0.4.1, 0.4.2, 0.4.3 | — |
References
- VDB-422865 | a2aproject a2a-rs Push Notification push_notification_sender.rs HttpPushSender server-side request forgery vdb-entry technical-description
- VDB-422865 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- CVE-2026-113704 | CVE Analysis and Report third-party-advisory
- Submit #1014883 | a2aproject a2a-rs a2a-server-lf ≤ 0.4.3 SSRF third-party-advisory
- https://github.com/a2aproject/a2a-rs/pull/124 issue-tracking patch
- https://github.com/a2aproject/a2a-rs/commit/2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224 patch
- https://github.com/a2aproject/a2a-rs/ product