CyberRota Analysis
AI-GeneratedA vulnerability exists in the a2a-java library version 1.2.0, specifically in the BasePushNotificationSender.dispatchNotification function, which is susceptible to HTTP response splitting due to improper handling of the Authorization Header Construction. This flaw can be exploited remotely, potentially allowing attackers to manipulate HTTP responses and execute further attacks. Organizations using this library should prioritize upgrading to version 1.3.0 to mitigate the risk associated with this high-severity vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A weakness has been identified in a2aproject a2a-java 1.2.0. The affected element is the function BasePushNotificationSender.dispatchNotification of the file server-common/src/main/java/org/a2aproject/sdk/server/tasks/BasePushNotificationSender.java of the component Authorization Header Construction. This manipulation causes http response splitting. The attack can be initiated remotely. Upgrading to version 1.3.0 is sufficient to fix this issue. Patch name: 247a655043f145f6f8e3853724b6a543eaa02001. You should upgrade the affected component.