CVE-2026-116476Medium· 5.4▾ SunlitA weakness has been identified in a2aproject a2a-dotnet up to 1.0.0-preview3. The affected element is the function TaskProjection.ApplyStatus of the component TaskProjection. Executing a manipulation can lead to race condition. The attac…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 27.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
A weakness has been identified in a2aproject a2a-dotnet up to 1.0.0-preview3. The affected element is the function TaskProjection.ApplyStatus of the component TaskProjection. Executing a manipulation can lead to race condition. The attack may be performed from remote. The pull request to fix this issue awaits acceptance.
a2a-dotnet 1.0.0-preview3Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116477Medium· 4.3a2aproject a2a-dotnet Parser A2AJsonRpcProcessor.cs A2AJsonRpcProcessor.ProcessRequestAsync information exposure
CVE-2026-118128Medium· 6.5a2aproject a2a-js Task Status Update result_manager.ts ResultManager.applyStatusUpdate race condition
CVE-2026-117507Medium· 5.4a2aproject a2a-java TaskManager.saveTaskEvent race condition
CVE-2026-113707Medium· 5.4a2aproject a2a-rs inmemory.rs update race condition
CVE-2026-117506Medium· 4.3a2aproject a2a-java Push Notification Config Store JpaDatabasePushNotificationConfigStore.java InMemoryPushNotificationConfigStore.setInfo resource consumption
CVE-2026-117505Medium· 4.3a2aproject a2a-java ChildQueue queue.offer resource consumption