CVE-2026-113704

EUVD-2026-106865

20.10.2026, 22:19

A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file crates/server/src/push_notification_sender.rs of the component Push Notification Handler. Such manipulation of the argument TaskPushNotificationConfig leads to server-side request forgery. The attack may be launched remotely. The name of the patch is 2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224. Applying a patch is advised to resolve this issue.

SSRF

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.3 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: 40.26%

Common Weakness Enumeration

CWE-918 - Server-Side Request Forgery (SSRF)
The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References

https://github.com/a2aproject/a2a-rs/

https://github.com/a2aproject/a2a-rs/commit/2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224

https://github.com/a2aproject/a2a-rs/pull/124

https://vuldb.com/cve/CVE-2026-113704

https://vuldb.com/submit/1014883

https://vuldb.com/vuln/422865

https://vuldb.com/vuln/422865/cti