CVE-2026-90819
HighCVSS 7.3Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
A weakness has been identified in a2aproject a2a-java 1.2.0. The affected element is the function BasePushNotificationSender.dispatchNotification of the file server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java of the component Authorization Header Construction. This manipulation causes http response splitting. The attack can be initiated remotely. Upgrading to version 1.3.0 is sufficient to fix this issue. Patch name: 247a655043f145f6f8e3853724b6a543eaa02001. You should upgrade the affected component.
Risk Assessment
An attacker can exploit HTTP response splitting to inject malicious headers or content, potentially leading to cache poisoning, session hijacking, or other attacks.
Recommendation
Upgrade a2a-java to version 1.3.0 or later, which includes a fix for the vulnerability.
Other vulnerabilities in a2a-java
See all- CVE-2026-117507Medium
A security vulnerability has been detected in a2aproject a2a-java up to 1.2.0.Final. This impacts the function TaskManager.saveTaskEvent. The manipulation leads to a race condition. The attack may be initiated remotely. Upgrading to version 1.3.0.Final fixes this issue (patch identifier: 6b8e1e085c35e970ef0048901cd25850e4791ec2).
- CVE-2026-117506Medium
A weakness has been identified in a2aproject a2a-java up to 1.2.0.Final. This affects the function InMemoryPushNotificationConfigStore.setInfo of the file extras/push-notification-config-store-database-jpa/src/main/java/org/a2aproject/sdk/extras/pushnotificationconfigstore/database/jpa/JpaDatabasePushNotificationConfigStore.java of the component Push Notification Config Store. Manipulation can lead to resource consumption. The attack can be launched remotely. Upgrading to version 1.3.0.Final mitigates this issue (patch: b478810a03b4a16841d36aca5c6e87d8f48fce67).
- CVE-2026-117505Medium
A security flaw has been discovered in a2aproject a2a-java up to 1.2.0.Final. The impacted element is the function queue.offer of the component ChildQueue. Manipulation results in resource consumption. The attack can be initiated remotely. Upgrading to version 1.3.0.Final is sufficient to resolve this issue (patch: be663f806efcfdddd2805d214fae4998379ac5f2).
- CVE-2026-116479Medium
A flaw was found in a2a-java up to 1.2.0.Final affecting the getMessage function of the JSON-RPC Error Handler component. The manipulation causes information exposure through error messages. The attack can be launched remotely, and upgrading to version 1.3.0.Final fixes the issue.
- CVE-2026-90820Medium
A vulnerability has been detected in a2aproject a2a-java 1.2.0, in the function AuthorizationRequestHandlerDecorator.onListTasks, leading to missing authorization. The attack can be launched remotely. Upgrading to version 1.3.0 resolves the issue.
Original NVD description (English source)
A weakness has been identified in a2aproject a2a-java 1.2.0. The affected element is the function BasePushNotificationSender.dispatchNotification of the file server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java of the component Authorization Header Construction. This manipulation causes http response splitting. The attack can be initiated remotely. Upgrading to version 1.3.0 is sufficient to fix this issue. Patch name: 247a655043f145f6f8e3853724b6a543eaa02001. You should upgrade the affected component.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS