{"id":"CVE-2026-90819","summary":"a2aproject a2a-java Authorization Header Construction BasePushNotificationSender.java BasePushNotificationSender.dispatchNotification response splitting","details":"A weakness has been identified in a2aproject a2a-java 1.2.0. The affected element is the function BasePushNotificationSender.dispatchNotification of the file server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java of the component Authorization Header Construction. This manipulation causes http response splitting. The attack can be initiated remotely. Upgrading to version 1.3.0 is sufficient to fix this issue. Patch name: 247a655043f145f6f8e3853724b6a543eaa02001. You should upgrade the affected component.","modified":"2026-10-28T11:09:50.662429663Z","published":"2026-09-14T20:30:11.624Z","database_specific":{"cna_assigner":"VulDB","cwe_ids":["CWE-113","CWE-93"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90819.json"},"references":[{"type":"WEB","url":"https://github.com/a2aproject/a2a-java/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90819.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-90819"},{"type":"ADVISORY","url":"https://vuldb.com/cve/CVE-2026-90819"},{"type":"ADVISORY","url":"https://vuldb.com/submit/922996"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/403322"},{"type":"REPORT","url":"https://vuldb.com/vuln/403322/cti"},{"type":"FIX","url":"https://github.com/a2aproject/a2a-java/commit/247a655043f145f6f8e3853724b6a543eaa02001"},{"type":"FIX","url":"https://github.com/a2aproject/a2a-java/pull/1043"},{"type":"FIX","url":"https://github.com/a2aproject/a2a-java/pull/1053"},{"type":"FIX","url":"https://github.com/a2aproject/a2a-java/releases/tag/v1.3.0.Final"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/a2aproject/a2a-java","events":[{"introduced":"0b5c1f8d39cbd5171546e6ae6256b2834ab49671"},{"fixed":"247a655043f145f6f8e3853724b6a543eaa02001"},{"fixed":"43bde91e3319f0a92db3ac2104215dcdbbb77679"}],"database_specific":{"extracted_events":[{"strategy":"StandaloneSingleVersion","range":[{"introduced":"1.2.0"},{"last_affected":"1.2.0"}],"source":"AFFECTED_FIELD"},{"source":"REFERENCES_COMMIT","range":[{"fixed":"247a655043f145f6f8e3853724b6a543eaa02001"}]},{"range":[{"fixed":"43bde91e3319f0a92db3ac2104215dcdbbb77679"}],"source":"REFERENCES_TAG","original_tag":"v1.3.0.Final"}]}}],"versions":["1.2.0","v1.2.0.Final"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90819.json","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["285769629431260719593754034795901405497","268788092287919770334531583268205077233","20738579780469087496191299530207729739"],"threshold":0.9},"id":"CVE-2026-90819-042422f6","signature_type":"Line","signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/247a655043f145f6f8e3853724b6a543eaa02001","target":{"file":"spec/src/main/java/org/a2aproject/sdk/spec/AuthenticationInfo.java"}},{"signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/247a655043f145f6f8e3853724b6a543eaa02001","target":{"file":"server-common/src/test/java/org/a2aproject/sdk/server/tasks/PushNotificationSenderTest.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["329781071534993170828692589866040956571","168800400444528044332644656106908386908","304987906020486946857117910885636102606","280767879335690888397355103078790829323","219607206518799750877941388174582444864","14566755433798433323269629968044106674","290812241019625769509387448599526705212","13170019314066944959137709990186058527","339346095205115435162551830572911728297","60994485994722555844842606524707384123","33850742151134165185080007863503429827","211814563693674583583282923140173737183","121813607368528839877164658292157251243","262478292545455178320926480856846361063"]},"id":"CVE-2026-90819-3a1f8baa","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/247a655043f145f6f8e3853724b6a543eaa02001","target":{"file":"server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java"},"deprecated":false,"digest":{"line_hashes":["44520875144581135332958572015862005105","242952725110588196798319704297459824930","31984604033419880085127380864083126305","336077544607423456127983458697964692442","255798782399849599537757019728965026254","233893601185048865198132850786865710505","88271614517602136564570543881985345894","185056817437454860545053381656694198742","90698628312919822177855156946104264069","28315878928786126261252973151848789422","157062545076297046161066666103620241753","80277039844464273566096301713318300709","329891778947019142230072296731653015126","105135349804760838859480469610730392589","102715412356406950219770955940244365114"],"threshold":0.9},"id":"CVE-2026-90819-a0631515","signature_type":"Line"},{"signature_version":"v1","source":"https://github.com/a2aproject/a2a-java/commit/247a655043f145f6f8e3853724b6a543eaa02001","target":{"function":"dispatchNotification","file":"server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java"},"deprecated":false,"digest":{"function_hash":"13695897972917501982974852893132390054","length":1591},"id":"CVE-2026-90819-a9d188f2","signature_type":"Function"}],"vanir_signatures_modified":"2026-10-28T11:09:50Z"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X"}]}