HTTP Response Splitting Vulnerability in a2aproject a2a-java Product
CVE-2026-90819

6.9MEDIUM

Key Information:

Vendor

A2aproject

Status
A2a-java
Vendor
CVE Published:
14 September 2026

What is CVE-2026-90819?

A vulnerability has been discovered in a2aproject's a2a-java version 1.2.0, specifically within the BasePushNotificationSender.dispatchNotification function. This weakness allows for HTTP response splitting, which can enable attackers to craft manipulated responses that may impact the integrity of communication. The issue can be exploited remotely, emphasizing the need for immediate action. To mitigate this vulnerability, users are strongly encouraged to upgrade to version 1.3.0, which includes the necessary patch to address this critical security flaw.

Affected Version(s)

a2a-java 1.2.0

a2a-java 1.3.0

References

https://vuldb.com/vuln/403322
vdb-entrytechnical-description
https://vuldb.com/vuln/403322/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-90819
third-party-advisory

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

ez-lbz (VulDB User)
.