CVE-2026-113707Medium· 5.4▾ SunlitA security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the file a2a-server/src/task_store/inmemory.rs. The manipulation results in race condition. The attac…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 29.7 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the file a2a-server/src/task_store/inmemory.rs. The manipulation results in race condition. The attack may be performed from remote. The patch is identified as 7050c7d329238539424ee46440e23b91c4825bee. It is advisable to implement a patch to correct this issue.
a2a-rs 0.4.0a2a-rs 0.4.1a2a-rs 0.4.2a2a-rs 0.4.3a2a-rs 0.4.4Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-113705Medium· 5.3a2aproject a2a-rs error.rs information exposure
CVE-2026-113706Low· 3.5a2aproject a2a-rs inmemory.rs information disclosure
CVE-2026-113704High· 7.3a2aproject a2a-rs Push Notification push_notification_sender.rs HttpPushSender server-side request forgery
CVE-2026-111763Medium· 5.7A2A Java SDK send client credentials under server-controlled HTTP header name, enabling leakage via redirect
CVE-2026-111764High· 7.5A2A Java SDK has a fail-open default task authorization
CVE-2026-111765High· 7.5A2A Java SDK: Android synchronous POST forwards credentials across authorities after incomplete redirect fix