CVE-2026-113704 a2aproject a2a-rs Push Notification push_notification_sender.rs HttpPushSender server-side request forgery
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-113704?
CVE-2026-113704 is a medium-severity vulnerability in a2aproject a2a-rs, published on 20 Oct 2026.
Official description
A vulnerability has been found in a2aproject a2a-rs up to 0.4.3. This affects the function HttpPushSender of the file crates/server/src/push_notification_sender.rs of the component Push Notification Handler. Such manipulation of the argument TaskPushNotificationConfig leads to server-side request forgery. The attack may be launched remotely. The name of the patch is 2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224. Applying a patch is advised to resolve this issue.
Weakness: CWE-918
Which versions are affected by CVE-2026-113704?
How do I fix CVE-2026-113704?
No fix has been published for CVE-2026-113704 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-113704 being exploited?
There is no known exploitation of CVE-2026-113704 in the wild and no public exploit code.
Sources
Also known as GHSA-cwqm-f4mw-5mhx.