A2A Dotnet
Monthly
Information exposure through error messages in the .NET A2A SDK (a2aproject a2a-dotnet) up to and including 1.0.0-preview2 causes the JSON-RPC endpoint to echo raw System.Text.Json parser output back to the caller. When a request body fails parsing, A2AJsonRpcProcessor.ProcessRequestAsync returns the -32700 ParseError response containing ex.Message, which discloses JSON paths, line and byte positions, exception type names and library details rather than a generic error. The exposure is diagnostic metadata only - no credentials or user data are implicated, and the independently assessed impact is low (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N); no public exploit has been identified at time of analysis, and upgrading to 1.0.0-preview3 resolves the issue.
Race condition in a2a-dotnet through 1.0.0-preview3 allows a low-privilege authenticated remote client to disturb task status and background-cancellation bookkeeping by submitting concurrent SendMessage or SendStreamingMessage requests for the same TaskId, producing limited integrity and availability impact. The trigger is a CWE-362 race in TaskProjection.ApplyStatus and the A2AServer cancellation-registration path, which the proposed fix in PR #453 replaces with lock-guarded reservation and release. Severity is moderate (CVSS 5.3), no public exploit code has been identified at time of analysis, and the fix has not yet been accepted or released.
Information exposure through error messages in the .NET A2A SDK (a2aproject a2a-dotnet) up to and including 1.0.0-preview2 causes the JSON-RPC endpoint to echo raw System.Text.Json parser output back to the caller. When a request body fails parsing, A2AJsonRpcProcessor.ProcessRequestAsync returns the -32700 ParseError response containing ex.Message, which discloses JSON paths, line and byte positions, exception type names and library details rather than a generic error. The exposure is diagnostic metadata only - no credentials or user data are implicated, and the independently assessed impact is low (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N); no public exploit has been identified at time of analysis, and upgrading to 1.0.0-preview3 resolves the issue.
Race condition in a2a-dotnet through 1.0.0-preview3 allows a low-privilege authenticated remote client to disturb task status and background-cancellation bookkeeping by submitting concurrent SendMessage or SendStreamingMessage requests for the same TaskId, producing limited integrity and availability impact. The trigger is a CWE-362 race in TaskProjection.ApplyStatus and the A2AServer cancellation-registration path, which the proposed fix in PR #453 replaces with lock-guarded reservation and release. Severity is moderate (CVSS 5.3), no public exploit code has been identified at time of analysis, and the fix has not yet been accepted or released.