CVE-2026-113707
Received
Received - Intake
Race Condition in a2a-rs Task Store
Vulnerability report for CVE-2026-113707, including description, CVSS score, EPSS score, affected products, exploitability, helpful resources, and attack-flow context.
Publication date: 2026-10-21
Last updated on: 2026-10-21
Assigner: VulDB
Description
Description
A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the file a2a-server/src/task_store/inmemory.rs. The manipulation results in race condition. The attack may be performed from remote. The patch is identified as 7050c7d329238539424ee46440e23b91c4825bee. It is advisable to implement a patch to correct this issue.
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| a2aproject | a2a-rs | 0.4.0 |
| a2aproject | a2a-rs | 0.4.1 |
| a2aproject | a2a-rs | 0.4.2 |
| a2aproject | a2a-rs | 0.4.3 |
| a2aproject | a2a-rs | 0.4.4 |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-362 | The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently. |
