CVE-2026-90819: a2aproject a2a-java Authorization Header Construction BasePushNotificationSender.java BasePushNotificationSender.dispatchNotification response splitting
A weakness has been identified in a2aproject a2a-java 1.2.0. The affected element is the function BasePushNotificationSender.dispatchNotification of the file server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java of the component Authorization Header Construction. This manipulation causes http response splitting. The attack can be initiated remotely. Upgrading to version 1.3.0 is sufficient to fix this issue. Patch name: 247a655043f145f6f8e3853724b6a543eaa02001. You should upgrade the affected component.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
a2aproject a2a-java Authorization Header Construction BasePushNotificationSender.java BasePushNotificationSender.dispatchNotificationto a version that resolves this vulnerability.Fixed in 1.3.0Patch 247a655043f145f6f8e3853724b6a543eaa02001
Event History
Frequently Asked Questions
Which deployments are affected?
a2aproject a2a-java version 1.2.0 is identified as affected. The vulnerable code is in BasePushNotificationSender.dispatchNotification within the Authorization Header Construction component.
Does exploitation require authentication or user interaction?
No. The supplied severity vector indicates network-based exploitation with low attack complexity, no privileges required, and no user interaction required.
What is the recommended remediation?
Upgrade a2aproject a2a-java to version 1.3.0. The referenced fix is patch 247a655043f145f6f8e3853724b6a543eaa02001.