From d3518ad19d456fd0f0fe45be8a0f4e0968d8567e Mon Sep 17 00:00:00 2001 From: tuanaiseo Date: Fri, 8 May 2026 03:42:49 +0700 Subject: [PATCH] fix(security): non-thread-safe sequence number generation may cau (#5320) `SequenceNumber.Increment()` uses `this._sequenceNumber++` without synchronization. In concurrent streaming scenarios, this can produce race conditions and inconsistent sequencing, which may break event ordering guarantees and potentially allow response-mixing or state confusion. Affected files: SequenceNumber.cs Signed-off-by: tuanaiseo <221258316+tuanaiseo@users.noreply.github.com> Co-authored-by: Jacob Alber --- .../Responses/Streaming/SequenceNumber.cs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/dotnet/src/Microsoft.Agents.AI.Hosting.OpenAI/Responses/Streaming/SequenceNumber.cs b/dotnet/src/Microsoft.Agents.AI.Hosting.OpenAI/Responses/Streaming/SequenceNumber.cs index d119275f71..e125c4269e 100644 --- a/dotnet/src/Microsoft.Agents.AI.Hosting.OpenAI/Responses/Streaming/SequenceNumber.cs +++ b/dotnet/src/Microsoft.Agents.AI.Hosting.OpenAI/Responses/Streaming/SequenceNumber.cs @@ -13,5 +13,5 @@ internal sealed class SequenceNumber /// Gets the next sequence number. /// /// The next sequence number. - public int Increment() => this._sequenceNumber++; + public int Increment() => System.Threading.Interlocked.Increment(ref this._sequenceNumber) - 1; }