CVE-2026-113704 | a2aproject a2a-rs up to 0.4.3 Push Notification push_notification_sender.rs HttpPushSender TaskPushNotificationConfig server-side request forgery (ID 124)

SecurityVulns
Yanac

A vulnerability categorized as critical has been discovered in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file crates/server/src/push_notification_sender.rs of the component Push Notification Handler. Such manipulation of the argument TaskPushNotificationConfig leads to server-side request forgery.

This vulnerability is traded as CVE-2026-113704. The attack may be launched remotely. There is no exploit available.

Applying a patch is advised to resolve this issue.VulDB Recent EntriesRead More