a2aproject a2a-dotnet Parser A2AJsonRpcProcessor.cs A2AJsonRpcProcessor.ProcessRequestAsync information exposure
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fix or patch referenced
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The a2a-dotnet SDK (the A2A protocol library for .NET, used in its ASP.NET Core JSON-RPC request handling) is affected by this vulnerability. A remote attacker could send crafted requests that cause the server to return error messages revealing sensitive internal information.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
A security vulnerability has been detected in a2aproject a2a-dotnet up to 1.0.0-preview2. The impacted element is the function A2AJsonRpcProcessor.ProcessRequestAsync of the file src/A2A.AspNetCore/A2AJsonRpcProcessor.cs of the component Parser. The manipulation leads to information exposure through error message. It is possible to initiate the attack remotely. Upgrading to version 1.0.0-preview3 is sufficient to resolve this issue. The identifier of the patch is ccbd12b6108a6a8f0fd5d8b4a9ece3c8a94ba1e4. Upgrading the affected component is recommended.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- a2aproject a2a-dotnet
1.0.0-preview2