A2A Java
Monthly
Missing authorization in the A2A Java SDK (a2aproject/a2a-java) 1.2.0 allows a caller with a valid account to invoke the ListTasks operation without the list-scoped read check that guards other task operations, so task listings are returned to principals that the configured TaskAuthorizationProvider may have intended to reject entirely. The flaw lives in AuthorizationRequestHandlerDecorator.onListTasks in server-common, which delegated to the handler without first consulting the authorization provider for the list scope, leaving protection to per-task filtering inside the TaskStore. It is fixed in release 1.3.0 (tag v1.3.0.Final, commit e9a1abf9c90c02b16d17293afdc3cc2f555d63a6); CVSS 4.0 base is 5.3, there is no CISA KEV listing and no public exploit code identified at time of analysis.
HTTP response splitting in a2a-java 1.2.0 allows attackers who control push notification authentication credentials to inject arbitrary HTTP headers by embedding CR/LF characters in the Authorization header assembled by `BasePushNotificationSender.dispatchNotification()`. The root cause is direct concatenation of client-supplied `scheme` and `credentials` fields into an outbound HTTP header without CRLF sanitization. No public exploit has been identified at time of analysis; vendor-confirmed patch is available as v1.3.0.Final.
Missing authorization in the A2A Java SDK (a2aproject/a2a-java) 1.2.0 allows a caller with a valid account to invoke the ListTasks operation without the list-scoped read check that guards other task operations, so task listings are returned to principals that the configured TaskAuthorizationProvider may have intended to reject entirely. The flaw lives in AuthorizationRequestHandlerDecorator.onListTasks in server-common, which delegated to the handler without first consulting the authorization provider for the list scope, leaving protection to per-task filtering inside the TaskStore. It is fixed in release 1.3.0 (tag v1.3.0.Final, commit e9a1abf9c90c02b16d17293afdc3cc2f555d63a6); CVSS 4.0 base is 5.3, there is no CISA KEV listing and no public exploit code identified at time of analysis.
HTTP response splitting in a2a-java 1.2.0 allows attackers who control push notification authentication credentials to inject arbitrary HTTP headers by embedding CR/LF characters in the Authorization header assembled by `BasePushNotificationSender.dispatchNotification()`. The root cause is direct concatenation of client-supplied `scheme` and `credentials` fields into an outbound HTTP header without CRLF sanitization. No public exploit has been identified at time of analysis; vendor-confirmed patch is available as v1.3.0.Final.