CVE-2026-90819

EUVD-2026-78085

14.09.2026, 21:17

A weakness has been identified in a2aproject a2a-java 1.2.0. The affected element is the function BasePushNotificationSender.dispatchNotification of the file server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java of the component Authorization Header Construction. This manipulation causes http response splitting. The attack can be initiated remotely. Upgrading to version 1.3.0 is sufficient to fix this issue. Patch name: 247a655043f145f6f8e3853724b6a543eaa02001. You should upgrade the affected component.

CRLF Injection

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.3 HIGH	NETWORK	LOW	NONE	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Awaiting analysis

This vulnerability is currently awaiting analysis.

Base Score

CVSS 3.x

EPSS Score

Percentile: Unknown

Common Weakness Enumeration

CWE-93 - Improper Neutralization of CRLF Sequences ('CRLF Injection')
The software uses CRLF (carriage return line feeds) as a special element, e.g. to separate lines or records, but it does not neutralize or incorrectly neutralizes CRLF sequences from inputs.

References

https://github.com/a2aproject/a2a-java/

https://github.com/a2aproject/a2a-java/commit/247a655043f145f6f8e3853724b6a543eaa02001

https://github.com/a2aproject/a2a-java/pull/1043

https://github.com/a2aproject/a2a-java/pull/1053

https://github.com/a2aproject/a2a-java/releases/tag/v1.3.0.Final

https://vuldb.com/cve/CVE-2026-90819

https://vuldb.com/submit/922996

https://vuldb.com/vuln/403322

https://vuldb.com/vuln/403322/cti