Back
CVE-2026-90819
a2aproject a2a-java Authorization Header Construction BasePushNotificationSender.java BasePushNotificationSender.dispatchNotification response splitting
Medium6.9EPSS 0.66%
- Published
- Updated
- Reserved
- Assigned by
- VulDB
Description
A weakness has been identified in a2aproject a2a-java 1.2.0. The affected element is the function BasePushNotificationSender.dispatchNotification of the file server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java of the component Authorization Header Construction. This manipulation causes http response splitting. The attack can be initiated remotely. Upgrading to version 1.3.0 is sufficient to fix this issue. Patch name: 247a655043f145f6f8e3853724b6a543eaa02001. You should upgrade the affected component.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| VulDBCNA (assigner) | 4.0 | Medium6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X |
| VulDBCNA (assigner) | 3.1 | High7.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C |
| VulDBCNA (assigner) | 3.0 | High7.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C |
| VulDBCNA (assigner) | 2.0 | High7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P/E:ND/RL:OF/RC:C |
| NVDNVD · Deferred | 4.0 | Medium6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
- EPSS (exploitation in 30 days)
- 0.66% · top 48% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: none · Automatable: yes · Technical impact: partial
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.9.
Weakness
Affected products
- affected 1.2.0
- unaffected 1.3.0
References (9)
- VDB-403322 | a2aproject a2a-java Authorization Header Construction BasePushNotificationSender.java BasePushNotificationSender.dispatchNotification response splitting (opens in a new tab)vdb-entrytechnical-description
- VDB-403322 | CTI Indicators (IOB, IOC, IOA) (opens in a new tab)signaturepermissions-required
- CVE-2026-90819 | CVE Analysis and Report (opens in a new tab)third-party-advisory
- Submit #922996 | a2aproject a2a-java v1.2.0 CRLF (opens in a new tab)third-party-advisory
- https://github.com/a2aproject/a2a-java/pull/1043 (opens in a new tab)issue-trackingpatch
- https://github.com/a2aproject/a2a-java/pull/1053 (opens in a new tab)issue-trackingpatch
- https://github.com/a2aproject/a2a-java/commit/247a655043f145f6f8e3853724b6a543eaa02001 (opens in a new tab)patch
- https://github.com/a2aproject/a2a-java/releases/tag/v1.3.0.Final (opens in a new tab)patch
- https://github.com/a2aproject/a2a-java/ (opens in a new tab)product
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2026-90819)Record last updated .