A2aproject - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/a2aproject/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioMon, 14 Sep 2026 21:36:26 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgHTTP Response Splitting Vulnerability in a2aproject a2a-javahttps://feed.craftedsignal.io/briefs/2026-09-cve-2026-90819-http-response-splitting/Mon, 14 Sep 2026 21:36:26 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-cve-2026-90819-http-response-splitting/CVE-2026-90819 identifies an HTTP response splitting vulnerability in the Authorization Header Construction component of a2a-java 1.2.0, enabling remote attackers to manipulate HTTP responses.A vulnerability has been identified in a2aproject a2a-java version 1.2.0, specifically within the Authorization Header Construction component. The flaw is located in the BasePushNotificationSender.dispatchNotification function within the server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java file. This vulnerability allows for HTTP response splitting, which can be initiated remotely. Successful exploitation may lead to header injection or the manipulation of subsequent HTTP responses served to users, potentially facilitating cross-site scripting (XSS) or cache poisoning attacks. The vulnerability is addressed in version 1.3.0 of the library. Organizations utilizing this SDK should prioritize upgrading to the patched version to mitigate potential exploitation risks.

Impact

Successful exploitation of CVE-2026-90819 allows a remote, unauthenticated attacker to manipulate HTTP response headers. This can result in unauthorized control over response content, potentially leading to cross-site scripting (XSS), web cache poisoning, or session hijacking for users interacting with applications utilizing the vulnerable a2a-java component.

Recommendation

  • Upgrade the a2a-java component to version 1.3.0 immediately to address CVE-2026-90819.
  • Audit applications utilizing a2a-java 1.2.0 to identify endpoints that trigger the BasePushNotificationSender.dispatchNotification function.
  • Review web server logs for HTTP response headers containing unusual line feed (\r) or carriage return (\n) characters, which are indicative of response splitting attempts.
]]>highadvisory