Approved changes feed: RSS · Atom
cpe:2.3:a:a2aproject:a2a-java:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | A2Aproject (9171c07a-a09d-5251-8cc7-4e0a425e24f2) |
|---|---|
| Product | A2A Java (87be5e3c-6fb4-57e1-a355-53a06a6255c7) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-90819 |
vulnerable | 2026-09-16 04:33:05.280740 |
a2aproject a2a-java Authorization Header Construction BasePushNotificationSender.java BasePushNotificationSender.dispatchNotification response splitting
HIGH (7.3)
A weakness has been identified in a2aproject a2a-java 1.2.0. The affected element is the function BasePushNotificationSender.dispatchNotification of the file server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java of the component Authorization Header Construction. This manipulation causes http response splitting. The attack can be initiated remotely. Upgrading to version 1.3.0 is sufficient to fix this issue. Patch name: 247a655043f145f6f8e3853724b6a543eaa02001. You should upgrade the affected component.
Published: 2026-09-14T20:30:11.624Z
Updated: 2026-09-15T14:25:39.139Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-90820 |
vulnerable | 2026-09-16 04:33:05.236674 |
a2aproject a2a-java AuthorizationRequestHandlerDecorator.java AuthorizationRequestHandlerDecorator.onListTasks authorization
MEDIUM (4.3)
A security vulnerability has been detected in a2aproject a2a-java 1.2.0. The impacted element is the function AuthorizationRequestHandlerDecorator.onListTasks of the file server-common/src/main/java/org/a2aproject/sdk/server/requesthandlers/AuthorizationRequestHandlerDecorator.java. Such manipulation leads to missing authorization. The attack can be launched remotely. Upgrading to version 1.3.0 is sufficient to resolve this issue. The name of the patch is e9a1abf9c90c02b16d17293afdc3cc2f555d63a6. The affected component should be upgraded.
Published: 2026-09-14T20:45:11.104Z
Updated: 2026-09-15T13:55:18.224Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.