A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix
影響: maven:org.a2aproject.sdk:a2a-java-sdk-http-client-android >= 1.3.0.Final, <= 1.3.1.Final → 1.3.2.Final
The GHSA-9rhm fix added this safe setting in AndroidA2AHttpClient.createConnection(): connection.setInstanceFollowRedirects(false); The synchronous POST builder later overwrites it: private boolean followRedirects = true; public A2AHttpResponse post() throws IOException { HttpURLConnection connection = createConnection("POST", false); connection.setInstanceFollowRedirects(followRedirects); // ... } The second assignment wins. JSONRPCTransport and RestTransport both add interceptor-produced head…
| CVE | CVE-2026-111765 |
|---|---|
| 정보원 | GitHub Advisory Database |
| 수집 시각 | 2026. 10. 22. 오전 01:17 |
| 데이터 | Markdown JSON |
2026. 10. 21. 오전 06:08, GitHub Advisory Database에서 "A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "높음"(high)입니다. 관련 기술: Java. CVE: CVE-2026-111765.