Live › vulnerability › CVE-2026-116477
Go to dashboardThe A2A .NET SDK's JSON-RPC request processor returns error messages that reveal internal information when handling crafted requests. A remote attacker can read that information from the responses.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-26 20:50 UTC. All times on this page are UTC.
Teams running an ASP.NET Core service that uses the a2a-dotnet SDK at or earlier to expose an A2A JSON-RPC endpoint are exposed. Services that do not use the SDK, or that run a newer preview, can skip it.
1.0.0-preview2No product ranges from the sources yet.
A2A package version in the project's NuGet references (for example dotnet list package); versions up to 1.0.0-preview2 are affected.src/A2A.AspNetCore/A2AJsonRpcProcessor.cs.1.0.0-preview3 or later, per the patch ccbd12b6108a6a8f0fd5d8b4a9ece3c8a94ba1e4.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security vulnerability has been detected in a2aproject a2a-dotnet up to 1.0.0-preview2. The impacted element is the function A2AJsonRpcProcessor.ProcessRequestAsync of the file src/A2A.AspNetCore/A2AJsonRpcProcessor.cs of the component Parser. The manipulation leads to information exposure through error message. It is possible to initiate the attack remotely. Upgrading to version 1.0.0-preview3 is sufficient to resolve this issue. The identifier of the patch is ccbd12b6108a6a8f0fd5d8b4a9ece3c8a94ba1e4. Upgrading the affected component is recommended.
This page as .md · .json · in your agent: get_signal("CVE-2026-116477")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.