HTTP Response Splitting Vulnerability in a2aproject a2a-java

A vulnerability has been identified in a2aproject a2a-java version 1.2.0, specifically within the Authorization Header Construction component. The flaw is located in the BasePushNotificationSender.dispatchNotification function within the server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java file. This vulnerability allows for HTTP response splitting, which can be initiated remotely. Successful exploitation may lead to header injection or the manipulation of subsequent HTTP responses served to users, potentially facilitating cross-site scripting (XSS) or cache poisoning attacks. The vulnerability is addressed in version 1.3.0 of the library. Organizations utilizing this SDK should prioritize upgrading to the patched version to mitigate potential exploitation risks.

Impact

Successful exploitation of CVE-2026-90819 allows a remote, unauthenticated attacker to manipulate HTTP response headers. This can result in unauthorized control over response content, potentially leading to cross-site scripting (XSS), web cache poisoning, or session hijacking for users interacting with applications utilizing the vulnerable a2a-java component.

Recommendation

• Upgrade the a2a-java component to version 1.3.0 immediately to address CVE-2026-90819.
• Audit applications utilizing a2a-java 1.2.0 to identify endpoints that trigger the BasePushNotificationSender.dispatchNotification function.
• Review web server logs for HTTP response headers containing unusual line feed (\r) or carriage return (\n) characters, which are indicative of response splitting attempts.