CVE-2026-116476: a2aproject a2a-dotnet TaskProjection TaskProjection.ApplyStatus race condition
A weakness has been identified in a2aproject a2a-dotnet up to 1.0.0-preview3. The affected element is the function TaskProjection.ApplyStatus of the component TaskProjection. Executing a manipulation can lead to race condition. The attack may be performed from remote. The pull request to fix this issue awaits acceptance.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
a2aproject a2a-dotnet versions up to and including 1.0.0-preview3 are affected, specifically the TaskProjection.ApplyStatus function in the TaskProjection component.
What level of access does an attacker need?
The attack can be performed remotely, but it requires low-level privileges. No user interaction is required.
What is the potential impact?
Successful manipulation of the race condition can affect integrity and availability at a low impact level. The provided vector indicates no confidentiality impact.
Is a fix available?
A pull request intended to fix the issue exists, but it is awaiting acceptance. No accepted patched release is identified in the provided data.