CVE-2026-113707

Deferred Deferred - Pending Action

Race Condition in a2a-rs Task Store

Publication date: 2026-10-21

Last updated on: 2026-10-28

Assigner: VulDB

Description

A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the file a2a-server/src/task_store/inmemory.rs. The manipulation results in race condition. The attack may be performed from remote. The patch is identified as 7050c7d329238539424ee46440e23b91c4825bee. It is advisable to implement a patch to correct this issue.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-28

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-113707

EUVD

EUVD-2026-106878

Affected Vendors & Products

Vendor	Product	Version / Range
a2aproject	a2a-rs	0.4.0
a2aproject	a2a-rs	0.4.1
a2aproject	a2a-rs	0.4.2
a2aproject	a2a-rs	0.4.3
a2aproject	a2a-rs	0.4.4

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-362	The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Attack-Flow Graph

Executive Summary

This vulnerability is a race condition in the a2a-rs library up to version 0.4.4, specifically in the InMemoryTaskStore::update function of the a2a-server/src/task_store/inmemory.rs file. A race condition occurs when multiple processes or threads access and modify shared data concurrently, leading to unpredictable behavior. In this case, concurrent operations could corrupt task states in the server.

Detection Guidance

To detect this vulnerability, check if your a2a-rs server version is up to 0.4.4. Use commands like 'cargo search a2a-rs' or inspect Cargo.toml for version details. Monitor logs for race condition errors in task state transitions.

Impact Analysis

The race condition may allow remote attackers to manipulate task states, causing inconsistent or corrupted task statuses. This could lead to tasks being incorrectly marked as completed, failed, or canceled, disrupting workflows that depend on accurate task state tracking in systems using the a2a-rs library.

Compliance Impact

The vulnerability is a race condition in task state management that could lead to inconsistent or corrupted task states. While not directly impacting GDPR or HIPAA compliance, such inconsistencies could affect data integrity and auditability, which are critical for compliance. However, the provided context does not explicitly link this issue to specific compliance failures or regulatory impacts.

Mitigation Strategies

Apply the patch commit 7050c7d329238539424ee46440e23b91c4825bee to update the InMemoryTaskStore::update function. Ensure all task state transitions are atomic and terminal states are immutable.

Hi! I’m here to help you understand CVE-2026-113707. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...