Description
A weakness has been identified in a2aproject a2a-dotnet up to 1.0.0-preview3. The affected element is the function TaskProjection.ApplyStatus of the component TaskProjection. Executing a manipulation can lead to race condition. The attack may be performed from remote. The pull request to fix this issue awaits acceptance.
Published: 2026-10-26
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: Race condition that may allow a remote attacker to alter task state and potentially cause denial of service or inconsistent data
Action: Assess Impact
AI Analysis

Impact

The vulnerability is a race condition in the TaskProjection.ApplyStatus method of a2a-dotnet. When multiple executions of this method occur simultaneously, a manipulation can lead to an inconsistent state or incorrect status updates. The attack is actionable from a remote context and could result in corrupted data or service disruption.

Affected Systems

This issue affects the a2a-dotnet component from a2aproject, specifically all releases up to and including 1.0.0-preview3. Users and administrators employing these versions are at risk.

Risk and Exploitability

The CVSS score of 5.3 indicates a moderate severity. The EPSS score is currently unavailable, and the vulnerability is not listed in the CISA KEV catalog. Remote exploitation requires the attacker to orchestrate concurrent executions of TaskProjection.ApplyStatus, suggesting a requirement for precise timing or repeated interactions. No immediate patch is available, as the fix remains in a pending pull request. Implementing the planned fix will eliminate the race condition, while temporary mitigations should reduce exploitation likelihood.

Generated by OpenCVE AI on October 26, 2026 at 20:22 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the latest a2a-dotnet release or merge pull request #453 once it is accepted by the project maintainers.
  • If a patch is unavailable, add a synchronization mechanism (e.g., a lock or mutex) around the TaskProjection.ApplyStatus logic to serialize concurrent accesses and prevent race conditions.
  • Limit concurrent task updates by queuing or throttling requests that target TaskProjection.ApplyStatus, and monitor application logs for concurrent modification events to detect potential exploitation attempts.

Generated by OpenCVE AI on October 26, 2026 at 20:22 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 19:00:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in a2aproject a2a-dotnet up to 1.0.0-preview3. The affected element is the function TaskProjection.ApplyStatus of the component TaskProjection. Executing a manipulation can lead to race condition. The attack may be performed from remote. The pull request to fix this issue awaits acceptance.
Title a2aproject a2a-dotnet TaskProjection TaskProjection.ApplyStatus race condition
First Time appeared A2aproject
A2aproject a2a-dotnet
Weaknesses CWE-362
CPEs cpe:2.3:a:a2aproject:a2a-dotnet:*:*:*:*:*:*:*:*
Vendors & Products A2aproject
A2aproject a2a-dotnet
References
Metrics cvssV2_0

{'score': 5.5, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:P/E:ND/RL:ND/RC:C'}

cvssV3_0

{'score': 5.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:X/RC:C'}

cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:X/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}

Subscriptions

A2aproject A2a-dotnet
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-26T18:45:20.493Z

Reserved: 2026-10-26T10:59:36.503Z

Link: CVE-2026-116476

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-26T19:16:30.587

Modified: 2026-10-26T19:16:30.587

Link: CVE-2026-116476

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-26T20:30:15Z

Weaknesses
  • CWE-362

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')