CVE-2026-113704: a2aproject a2a-rs Push Notification push_notification_sender.rs HttpPushSender server-side request forgery
A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file crates/server/src/pushnotificationsender.rs of the component Push Notification Handler. Such manipulation of the argument TaskPushNotificationConfig leads to server-side request forgery. The attack may be launched remotely. The name of the patch is 2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224. Applying a patch is advised to resolve this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224
Event History
Frequently Asked Questions
Which deployments are affected?
a2aproject a2a-rs versions up to and including 0.4.3 are affected where the Push Notification Handler uses HttpPushSender.
What does an attacker need to exploit this issue?
The attack can be launched remotely and does not require privileges or user interaction according to the supplied severity vector. Exploitation involves manipulating the TaskPushNotificationConfig argument used by HttpPushSender.
What is the remediation?
Apply patch 2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224. The provided data advises applying this patch to resolve the issue.