{"id":"CVE-2026-113707","title":"a2aproject a2a-rs inmemory.rs update race condition","summary":"A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the file a2a-server/src/task_store/inmemory.rs. The manipulation results in race condition. The attac…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C","cvssSource":"cna","cwe":["CWE-362"],"vendor":"a2aproject","product":"a2a-rs","affected":["a2a-rs 0.4.0","a2a-rs 0.4.1","a2a-rs 0.4.2","a2a-rs 0.4.3","a2a-rs 0.4.4"],"published":"2026-10-20","updated":"2026-10-20","sourceUpdated":"2026-10-20T23:30:22.622Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-113707","references":[{"url":"https://vuldb.com/vuln/422869","label":"VDB-422869 | a2aproject a2a-rs inmemory.rs update race condition"},{"url":"https://vuldb.com/vuln/422869/cti","label":"VDB-422869 | CTI Indicators (IOB, IOC, IOA)"},{"url":"https://vuldb.com/cve/CVE-2026-113707","label":"CVE-2026-113707 | CVE Analysis and Report"},{"url":"https://vuldb.com/submit/1015056","label":"Submit #1015056 | a2aproject a2a-rs a2a-server-lf ≤ 0.4.4 CWE-362"},{"url":"https://github.com/a2aproject/a2a-rs/pull/126"},{"url":"https://github.com/a2aproject/a2a-rs/commit/7050c7d329238539424ee46440e23b91c4825bee"},{"url":"https://github.com/a2aproject/a2a-rs/"}],"tags":["cve.org"],"ingestedAt":"2026-10-21T00:36:05.401Z","slug":"CVE-2026-113707","body":"## Overview\n\nA security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the file a2a-server/src/task_store/inmemory.rs. The manipulation results in race condition. The attack may be performed from remote. The patch is identified as 7050c7d329238539424ee46440e23b91c4825bee. It is advisable to implement a patch to correct this issue.\n\n## Affected\n\n- `a2a-rs 0.4.0`\n- `a2a-rs 0.4.1`\n- `a2a-rs 0.4.2`\n- `a2a-rs 0.4.3`\n- `a2a-rs 0.4.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}