CVE-2026-117507
MediumCVSS 5.4Summary
A security vulnerability has been detected in a2aproject a2a-java up to 1.2.0.Final. This impacts the function TaskManager.saveTaskEvent. The manipulation leads to a race condition. The attack may be initiated remotely. Upgrading to version 1.3.0.Final fixes this issue (patch identifier: 6b8e1e085c35e970ef0048901cd25850e4791ec2).
Risk Assessment
A race condition can lead to unpredictable application behavior, including data loss or incorrect state. It may be exploited remotely to disrupt service operation.
Recommendation
Update a2a-java to version 1.3.0.Final or later. Verify that the patch with the given identifier has been applied.
Other vulnerabilities in a2a-java
See all- CVE-2026-117506Medium
A weakness has been identified in a2aproject a2a-java up to 1.2.0.Final. This affects the function InMemoryPushNotificationConfigStore.setInfo of the file extras/push-notification-config-store-database-jpa/src/main/java/org/a2aproject/sdk/extras/pushnotificationconfigstore/database/jpa/JpaDatabasePushNotificationConfigStore.java of the component Push Notification Config Store. Manipulation can lead to resource consumption. The attack can be launched remotely. Upgrading to version 1.3.0.Final mitigates this issue (patch: b478810a03b4a16841d36aca5c6e87d8f48fce67).
- CVE-2026-117505Medium
A security flaw has been discovered in a2aproject a2a-java up to 1.2.0.Final. The impacted element is the function queue.offer of the component ChildQueue. Manipulation results in resource consumption. The attack can be initiated remotely. Upgrading to version 1.3.0.Final is sufficient to resolve this issue (patch: be663f806efcfdddd2805d214fae4998379ac5f2).
- CVE-2026-116479Medium
A flaw was found in a2a-java up to 1.2.0.Final affecting the getMessage function of the JSON-RPC Error Handler component. The manipulation causes information exposure through error messages. The attack can be launched remotely, and upgrading to version 1.3.0.Final fixes the issue.
- CVE-2026-90820Medium
A vulnerability has been detected in a2aproject a2a-java 1.2.0, in the function AuthorizationRequestHandlerDecorator.onListTasks, leading to missing authorization. The attack can be launched remotely. Upgrading to version 1.3.0 resolves the issue.
- CVE-2026-90819High
A weakness has been identified in a2aproject a2a-java 1.2.0. The affected element is the function BasePushNotificationSender.dispatchNotification of the file server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java of the component Authorization Header Construction. This manipulation causes http response splitting. The attack can be initiated remotely. Upgrading to version 1.3.0 is sufficient to fix this issue. Patch name: 247a655043f145f6f8e3853724b6a543eaa02001. You should upgrade the affected component.
Original NVD description (English source)
A security vulnerability has been detected in a2aproject a2a-java up to 1.2.0.Final. This impacts the function TaskManager.saveTaskEvent. The manipulation leads to race condition. The attack may be initiated remotely. Upgrading to version 1.3.0.Final will fix this issue. The identifier of the patch is 6b8e1e085c35e970ef0048901cd25850e4791ec2. The affected component should be upgraded.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS