{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aa2aprojecta2a-java1.2.0/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:a2aproject:a2a-java:1.2.0:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":7.3,"id":"CVE-2026-90819"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["a2a-java (1.2.0)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["a2aproject"],"content_html":"\u003cp\u003eA vulnerability has been identified in a2aproject a2a-java version 1.2.0, specifically within the Authorization Header Construction component. The flaw is located in the \u003ccode\u003eBasePushNotificationSender.dispatchNotification\u003c/code\u003e function within the \u003ccode\u003eserver-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java\u003c/code\u003e file. This vulnerability allows for HTTP response splitting, which can be initiated remotely. Successful exploitation may lead to header injection or the manipulation of subsequent HTTP responses served to users, potentially facilitating cross-site scripting (XSS) or cache poisoning attacks. The vulnerability is addressed in version 1.3.0 of the library. Organizations utilizing this SDK should prioritize upgrading to the patched version to mitigate potential exploitation risks.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation of CVE-2026-90819 allows a remote, unauthenticated attacker to manipulate HTTP response headers. This can result in unauthorized control over response content, potentially leading to cross-site scripting (XSS), web cache poisoning, or session hijacking for users interacting with applications utilizing the vulnerable a2a-java component.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the a2a-java component to version 1.3.0 immediately to address CVE-2026-90819.\u003c/li\u003e\n\u003cli\u003eAudit applications utilizing \u003ccode\u003ea2a-java\u003c/code\u003e 1.2.0 to identify endpoints that trigger the \u003ccode\u003eBasePushNotificationSender.dispatchNotification\u003c/code\u003e function.\u003c/li\u003e\n\u003cli\u003eReview web server logs for HTTP response headers containing unusual line feed (\u003ccode\u003e\\r\u003c/code\u003e) or carriage return (\u003ccode\u003e\\n\u003c/code\u003e) characters, which are indicative of response splitting attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-09-14T21:36:26Z","date_published":"2026-09-14T21:36:26Z","id":"https://feed.craftedsignal.io/briefs/2026-09-cve-2026-90819-http-response-splitting/","summary":"CVE-2026-90819 identifies an HTTP response splitting vulnerability in the Authorization Header Construction component of a2a-java 1.2.0, enabling remote attackers to manipulate HTTP responses.","title":"HTTP Response Splitting Vulnerability in a2aproject a2a-java","url":"https://feed.craftedsignal.io/briefs/2026-09-cve-2026-90819-http-response-splitting/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:a2aproject:a2a-Java:1.2.0:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}