CVE-2026-113707 Details
Description
A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the file a2a-server/src/task_store/inmemory.rs. The manipulation results in race condition. The attack may be performed from remote. The patch is identified as 7050c7d329238539424ee46440e23b91c4825bee. It is advisable to implement a patch to correct this issue.
A race condition vulnerability has been identified in the a2aproject a2a-rs application, specifically in versions up to 0.4.4. The issue arises in the InMemoryTaskStore::update function within the a2a-server component, located in the task_store directory. This vulnerability can be exploited remotely, leading to unprotected terminal task states and non-atomic cancellation transitions.
Users are advised to update to version 0.4.5, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/a2aproject/a2a-rs/ | [email protected] | Vendor |
| https://github.com/a2aproject/a2a-rs/commit/7050c7d329238539424ee46440e23b91c4825bee | [email protected] | Source CodeVendor |
| https://github.com/a2aproject/a2a-rs/pull/126 | [email protected] | Issue TrackingVendor |
| https://vuldb.com/cve/CVE-2026-113707 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1015056 | [email protected] | Permission Required |
| https://vuldb.com/vuln/422869 | [email protected] | Permission Required |
| https://vuldb.com/vuln/422869/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-362 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| a2aproject a2a-rs | <= 0.4.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | CVE Modified | CISA-ADP |
| Oct 21, 2026 | New CVE Received | [email protected] |