Read the docs
TI-2026-80563 Aliases CVE-2026-116477GHSA-6fjg-cx22-jv29

Error messages expose information in a2aproject a2a-dotnet

Priority LOW 24CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Information disclosure
Confidentiality · integrity · availability
Low · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-200.

Summary

The a2a-dotnet package from a2aproject is affected up to 1.0.0-preview2. The A2AJsonRpcProcessor.ProcessRequestAsync function in the parser returns error messages that contain sensitive information (CWE-209). A remote attacker with low privileges can read this information from the error output. The CVSS 4.0 base score is 5.3 (medium).

Written with Claude Haiku 5.5 from the sources below · 2026-10-31

Description from the CNA

A security vulnerability has been detected in a2aproject a2a-dotnet up to 1.0.0-preview2. The impacted element is the function A2AJsonRpcProcessor.ProcessRequestAsync of the file src/A2A.AspNetCore/A2AJsonRpcProcessor.cs of the component Parser. The manipulation leads to information exposure through error message. It is possible to initiate the attack remotely. Upgrading to version 1.0.0-preview3 is sufficient to resolve this issue. The identifier of the patch is ccbd12b6108a6a8f0fd5d8b4a9ece3c8a94ba1e4. Upgrading the affected component is recommended.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00315 24th percentileScored 2026-11-07
Fix Fixed a2a-dotnet (a2aproject): 1.0.0-preview3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
a2aprojecta2a-dotnet1.0.0-preview21.0.0-preview3Patch availableCNA
  • a2a-dotnet Vendora2aproject Affected 1.0.0-preview2 Fixed in 1.0.0-preview3 Patch available CNA

CPE names CNA · 1

CPEVersionsRoleVendor
cpe:2.3:a:a2aproject:a2a-dotnet:*:*:*:*:*:*:*:*——a2aproject
  • cpe:2.3:a:a2aproject:a2a-dotnet:*:*:*:*:*:*:*:* Versions — — ·a2aproject

Remediation

Upgrade a2a-dotnet to version 1.0.0-preview3, which fixes this issue. The fix is patch ccbd12b.

Written with Claude Haiku 5.5 from the sources below · 2026-10-31

  • Fix · CNA a2a-dotnet (a2aproject) Fixed in 1.0.0-preview3

Timeline

  1. 2026-10-26 Threatist record created from CVE-2026-116477
  2. 2026-10-27 Alias added: GHSA-6fjg-cx22-jv29
  3. 2026-10-31 CISA SSVC decision points changed

References

Patch 3

Other 1

  • TI-2026-76905 Android A2A Java SDK forwards API keys across redirects CVSS 3.1HIGH 7.5
  • TI-2026-76904 A2A Java SDK default task store skips authorization on task reads CVSS 3.1HIGH 7.5
  • TI-2026-76847 Server-side request forgery in A2A Java SDK push notifications CVSS 3.1MEDIUM 5.8
  • TI-2026-81183 Resource consumption in a2aproject a2a-go REST SSE handler CVSS 4.0MEDIUM 6.9
  • TI-2026-61722 HTTP response splitting in a2aproject a2a-java CVSS 4.0MEDIUM 6.9
  • TI-2026-81185 Denial of service in a2aproject a2a-go Distributed Manager Cancel CVSS 4.0MEDIUM 6.9
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences