CVE-2026-116477
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
A security vulnerability was detected in a2a-dotnet up to 1.0.0-preview2 affecting the A2AJsonRpcProcessor.ProcessRequestAsync function in src/A2A.AspNetCore/A2AJsonRpcProcessor.cs of the Parser component. The manipulation leads to information exposure through error messages. The attack can be launched remotely, and upgrading to version 1.0.0-preview3 resolves the issue.
Risk Assessment
A remote attacker may obtain sensitive information leaked in error messages, which can facilitate further attacks. The risk affects organizations using a2a-dotnet up to 1.0.0-preview2 in network-accessible environments.
Recommendation
Upgrade a2a-dotnet to version 1.0.0-preview3 containing patch ccbd12b6108a6a8f0fd5d8b4a9ece3c8a94ba1e4. Verify that all applications use the new version.
Other vulnerabilities in a2a-dotnet
Original NVD description (English source)
A security vulnerability has been detected in a2aproject a2a-dotnet up to 1.0.0-preview2. The impacted element is the function A2AJsonRpcProcessor.ProcessRequestAsync of the file src/A2A.AspNetCore/A2AJsonRpcProcessor.cs of the component Parser. The manipulation leads to information exposure through error message. It is possible to initiate the attack remotely. Upgrading to version 1.0.0-preview3 is sufficient to resolve this issue. The identifier of the patch is ccbd12b6108a6a8f0fd5d8b4a9ece3c8a94ba1e4. Upgrading the affected component is recommended.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS