CVE-2026-116479
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A flaw was found in a2a-java up to 1.2.0.Final affecting the getMessage function of the JSON-RPC Error Handler component. The manipulation causes information exposure through error messages. The attack can be launched remotely, and upgrading to version 1.3.0.Final fixes the issue.
Risk Assessment
A remote attacker may obtain sensitive information leaked in error messages, which can facilitate further attacks against the application. The risk affects organizations using a2a-java up to 1.2.0.Final in network-accessible environments.
Recommendation
Upgrade a2a-java to version 1.3.0.Final, which contains patch bbee3369f3825d0fba2373d821f6dc6d4fc82ec0. Verify that no components still use the older version.
Other vulnerabilities in a2a-java
See all- CVE-2026-117507Medium
A security vulnerability has been detected in a2aproject a2a-java up to 1.2.0.Final. This impacts the function TaskManager.saveTaskEvent. The manipulation leads to a race condition. The attack may be initiated remotely. Upgrading to version 1.3.0.Final fixes this issue (patch identifier: 6b8e1e085c35e970ef0048901cd25850e4791ec2).
- CVE-2026-117506Medium
A weakness has been identified in a2aproject a2a-java up to 1.2.0.Final. This affects the function InMemoryPushNotificationConfigStore.setInfo of the file extras/push-notification-config-store-database-jpa/src/main/java/org/a2aproject/sdk/extras/pushnotificationconfigstore/database/jpa/JpaDatabasePushNotificationConfigStore.java of the component Push Notification Config Store. Manipulation can lead to resource consumption. The attack can be launched remotely. Upgrading to version 1.3.0.Final mitigates this issue (patch: b478810a03b4a16841d36aca5c6e87d8f48fce67).
- CVE-2026-117505Medium
A security flaw has been discovered in a2aproject a2a-java up to 1.2.0.Final. The impacted element is the function queue.offer of the component ChildQueue. Manipulation results in resource consumption. The attack can be initiated remotely. Upgrading to version 1.3.0.Final is sufficient to resolve this issue (patch: be663f806efcfdddd2805d214fae4998379ac5f2).
- CVE-2026-90820Medium
A vulnerability has been detected in a2aproject a2a-java 1.2.0, in the function AuthorizationRequestHandlerDecorator.onListTasks, leading to missing authorization. The attack can be launched remotely. Upgrading to version 1.3.0 resolves the issue.
- CVE-2026-90819High
A weakness has been identified in a2aproject a2a-java 1.2.0. The affected element is the function BasePushNotificationSender.dispatchNotification of the file server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java of the component Authorization Header Construction. This manipulation causes http response splitting. The attack can be initiated remotely. Upgrading to version 1.3.0 is sufficient to fix this issue. Patch name: 247a655043f145f6f8e3853724b6a543eaa02001. You should upgrade the affected component.
Original NVD description (English source)
A flaw has been found in a2aproject a2a-java up to 1.2.0.Final. This impacts the function getMessage of the component JSON-RPC Error Handler. This manipulation causes information exposure through error message. The attack can be initiated remotely. Upgrading to version 1.3.0.Final will fix this issue. Patch name: bbee3369f3825d0fba2373d821f6dc6d4fc82ec0. Upgrading the affected component is advised.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS