CVE-2026-116477
a2aproject a2a-dotnet Parser A2AJsonRpcProcessor.cs A2AJsonRpcProcessor.ProcessRequestAsync information exposure
a2aproject a2a-dotnet
CVSS
5.3MediumExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
What fixes it
No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.
Description
A security vulnerability has been detected in a2aproject a2a-dotnet up to 1.0.0-preview2. The impacted element is the function A2AJsonRpcProcessor.ProcessRequestAsync of the file src/A2A.AspNetCore/A2AJsonRpcProcessor.cs of the component Parser. The manipulation leads to information exposure through error message. It is possible to initiate the attack remotely. Upgrading to version 1.0.0-preview3 is sufficient to resolve this issue. The identifier of the patch is ccbd12b6108a6a8f0fd5d8b4a9ece3c8a94ba1e4. Upgrading the affected component is recommended.
Text from CVE List
Affected versions 2
- a2a-dotnetaffected: 1.0.0-preview2CVE List
- a2a-dotnetunaffected: 1.0.0-preview3CVE List
References 8
- github.com/a2aproject/a2a-dotnet/pull/452Fixvia CVE List
- github.com/a2aproject/a2a-dotnet/commit/ccbd12b6108a6a8f0fd5d8b4a9ece3c8a94ba1e4Fixvia CVE List
- github.com/a2aproject/a2a-dotnet/releases/tag/v1.0.0-preview3Fixvia CVE List
- vuldb.com/cve/CVE-2026-116477Advisoryvia CVE List
- vuldb.com/submit/1014890Advisoryvia CVE List
- vuldb.com/vuln/426390Referencevia CVE List
- vuldb.com/vuln/426390/ctiReferencevia CVE List
- github.com/a2aproject/a2a-dotnet/Referencevia CVE List