GHSA-q78c-5jjq-57g8 A2A Java SDK has Server-Side Request Forgery (SSRF) in push-notification delivery

• Maven org.a2aproject.sdk:a2a-java-sdk-server-common: < 1.3.0.Final → fixed in 1.3.0.Final

--- • Ecosystem: Maven • Affected package: `org.a2aproject.sdk:a2a-java-sdk-server-common` (push-notification delivery) • Affected versions: `/latest/meta-data/iam/security-credentials/`. Use `returnImmediately: true`, header `A2A-Version: 1.0`, and role `ROLE_USER`. The URL is stored verbatim. (Equivalent via `CreateTaskPushNotificationConfig` on an existing task.) 3. As the task emits state/artifact updates, the sender POSTs each one to the stored URL, from the server's own network position: ``` POST /latest/meta-data/iam/security-credentials/ HTTP/1.1 Host: 169.254.169.254 Content-Type: application/json {"artifactUpdate":{"taskId":"...","artifact":{"parts":[{"text":"Progress update 1/20"}]}, ...}} ``` One `SendMessage` produced multiple server-side POSTs to the attacker-chosen internal path. Verified on `main` (commit `72d220c`, JDK 21) and unchanged on `1.2.0.Final`. Remediation Validate the *resolved* IP of the target and of every redirect hop before connecting: reject loopback / RFC1918 / link-local / metadata / unique-local / unspecified / multicast; restrict the scheme to `http`/`https`; cap redirects; and resolve-and-pin to defeat DNS rebinding. Enable by default, with a documented opt-out for deployments that intentionally target internal webhooks. The Go A2A SDK ships a dial-time resolved-IP guard of this shape by default. Workaround: until a fixed release, block the host's outbound egress to the metadata endpoint and internal ranges at the network layer. References • CWE-918: Server-Side Request Forgery: https://cwe.mitre.org/data/definitions/918.html