CVE-2026-116477
Received Received - Intake

Information Exposure via Error Message in a2a-dotnet

Publication date: 2026-10-26

Last updated on: 2026-10-26

Assigner: VulDB

Description
A security vulnerability has been detected in a2aproject a2a-dotnet up to 1.0.0-preview2. The impacted element is the function A2AJsonRpcProcessor.ProcessRequestAsync of the file src/A2A.AspNetCore/A2AJsonRpcProcessor.cs of the component Parser. The manipulation leads to information exposure through error message. It is possible to initiate the attack remotely. Upgrading to version 1.0.0-preview3 is sufficient to resolve this issue. The identifier of the patch is ccbd12b6108a6a8f0fd5d8b4a9ece3c8a94ba1e4. Upgrading the affected component is recommended.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-26
Last Modified
2026-10-26
Generated
2026-10-26
AI Q&A
2026-10-26
EPSS Evaluated
N/A
NVD
CVE-2026-116477
EUVD
EUVD-2026-110072

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
a2aproject a2a-dotnet 1.0.0-preview2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-200 The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CWE-209 The product generates an error message that includes sensitive information about its environment, users, or associated data.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an information exposure flaw in the A2A .NET library up to version 1.0.0-preview2. It occurs in the A2AJsonRpcProcessor.ProcessRequestAsync function where JSON-RPC parse errors leak internal details like file paths, line numbers, and library names from the System.Text.Json parser to clients. The issue violates CWE-209 by exposing sensitive information through error messages.

Detection Guidance

To detect this vulnerability, monitor for JSON-RPC parse errors that expose internal details like file paths, line numbers, or library names in error responses. Check server logs for error messages containing System.Text.Json parser specifics or A2AJsonRpcProcessor details. Use network traffic analysis tools to inspect JSON-RPC responses for non-generic error messages.

Impact Analysis

An attacker could remotely exploit this to gain internal system details, enabling server fingerprinting or further attacks. Sensitive data like file paths or library versions may be exposed, potentially aiding in targeted exploits. The impact is limited to information disclosure as no code execution or data modification is possible.

Compliance Impact

This vulnerability could violate GDPR's data minimization principle and HIPAA's security rule by exposing internal system details. Such information leaks may lead to non-compliance if sensitive data is inadvertently disclosed, potentially resulting in legal or regulatory penalties.

Mitigation Strategies

Upgrade the a2a-dotnet library to version 1.0.0-preview3 or later. This version includes a fix that sanitizes error responses to prevent information exposure. Apply the patch identified by commit ccbd12b6108a6a8f0fd5d8b4a9ece3c8a94ba1e4.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-116477. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart