CVE-2026-116477: a2aproject a2a-dotnet Parser A2AJsonRpcProcessor.cs A2AJsonRpcProcessor.ProcessRequestAsync information exposure
A security vulnerability has been detected in a2aproject a2a-dotnet up to 1.0.0-preview2. The impacted element is the function A2AJsonRpcProcessor.ProcessRequestAsync of the file src/A2A.AspNetCore/A2AJsonRpcProcessor.cs of the component Parser. The manipulation leads to information exposure through error message. It is possible to initiate the attack remotely. Upgrading to version 1.0.0-preview3 is sufficient to resolve this issue. The identifier of the patch is ccbd12b6108a6a8f0fd5d8b4a9ece3c8a94ba1e4. Upgrading the affected component is recommended.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
a2aproject/a2a-dotnetto a version that resolves this vulnerability.Fixed in 1.0.0-preview3Patch ccbd12b6108a6a8f0fd5d8b4a9ece3c8a94ba1e4
Event History
Frequently Asked Questions
Which deployments are affected?
a2aproject a2a-dotnet versions up to and including 1.0.0-preview2 are affected. The vulnerable code is the A2AJsonRpcProcessor.ProcessRequestAsync function in the ASP.NET Core parser component.
What does an attacker need to exploit this issue?
The issue can be initiated remotely and has low attack complexity. The supplied severity vector indicates that the attacker needs low privileges; no user interaction is required.
What is exposed if exploitation succeeds?
The vulnerability exposes information through error messages. The provided data rates the confidentiality impact as low and indicates no integrity or availability impact.
How should this be remediated?
Upgrade a2a-dotnet to version 1.0.0-preview3 or later. The referenced patch identifier is ccbd12b6108a6a8f0fd5d8b4a9ece3c8a94ba1e4.