Live › vulnerability › CVE-2026-116476
Go to dashboardThe a2a-dotnet library (A2A protocol SDK for .NET) up to 1.0.0-preview3 has a race condition in the TaskProjection.ApplyStatus function that a remote manipulation can trigger. The sources do not say what data an attacker can read or change.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 19:32 UTC. All times on this page are UTC.
Teams that use the a2a-dotnet library in a .NET service that handles A2A task status updates. The sources do not say which configurations or request paths reach TaskProjection.ApplyStatus, so whether a given deployment is exposed is unknown.
No product ranges from the sources yet.
A2A or a2a-dotnet package in your .csproj or packages.lock.json; affected versions are up to 1.0.0-preview31.0.0-preview3 once a fix is released; the sources say the fix pull request is still awaiting acceptanceEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A weakness has been identified in a2aproject a2a-dotnet up to 1.0.0-preview3. The affected element is the function TaskProjection.ApplyStatus of the component TaskProjection. Executing a manipulation can lead to race condition. The attack may be performed from remote. The pull request to fix this issue awaits acceptance.
This page as .md · .json · in your agent: get_signal("CVE-2026-116476")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.