Race Condition Vulnerability in a2aproject a2a-rs
CVE-2026-113707

5.3MEDIUM

Key Information:

Vendor

A2aproject

Status
A2a-rs
Vendor
CVE Published:
20 October 2026

What is CVE-2026-113707?

A security flaw has been identified in the a2aproject a2a-rs, specifically within the InMemoryTaskStore::update function located in the file a2a-server/src/task_store/inmemory.rs. This vulnerability allows for the occurrence of a race condition, which can be exploited remotely. It is essential to apply the patch identified as 7050c7d329238539424ee46440e23b91c4825bee to mitigate this issue effectively.

Affected Version(s)

a2a-rs 0.4.0

a2a-rs 0.4.1

a2a-rs 0.4.2

References

https://vuldb.com/vuln/422869
vdb-entrytechnical-description
https://vuldb.com/vuln/422869/cti
signaturepermissions-required
https://vuldb.com/cve/CVE-2026-113707
third-party-advisory

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

colorfullbz (VulDB User)
.