---
id: CVE-2026-113707
title: a2aproject a2a-rs inmemory.rs update race condition
summary: >-
  A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The
  affected element is the function InMemoryTaskStore::update of the file
  a2a-server/src/task_store/inmemory.rs. The manipulation results in race
  condition. The attac…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C'
cvssSource: cna
cwe:
  - CWE-362
vendor: a2aproject
product: a2a-rs
affected:
  - a2a-rs 0.4.0
  - a2a-rs 0.4.1
  - a2a-rs 0.4.2
  - a2a-rs 0.4.3
  - a2a-rs 0.4.4
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T23:30:22.622Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-113707'
references:
  - url: 'https://vuldb.com/vuln/422869'
    label: VDB-422869 | a2aproject a2a-rs inmemory.rs update race condition
  - url: 'https://vuldb.com/vuln/422869/cti'
    label: 'VDB-422869 | CTI Indicators (IOB, IOC, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-113707'
    label: CVE-2026-113707 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1015056'
    label: 'Submit #1015056 | a2aproject a2a-rs a2a-server-lf ≤ 0.4.4 CWE-362'
  - url: 'https://github.com/a2aproject/a2a-rs/pull/126'
  - url: >-
      https://github.com/a2aproject/a2a-rs/commit/7050c7d329238539424ee46440e23b91c4825bee
  - url: 'https://github.com/a2aproject/a2a-rs/'
tags:
  - cve.org
ingestedAt: '2026-10-21T00:36:05.401Z'
---

## Overview

A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the file a2a-server/src/task_store/inmemory.rs. The manipulation results in race condition. The attack may be performed from remote. The patch is identified as 7050c7d329238539424ee46440e23b91c4825bee. It is advisable to implement a patch to correct this issue.

## Affected

- `a2a-rs 0.4.0`
- `a2a-rs 0.4.1`
- `a2a-rs 0.4.2`
- `a2a-rs 0.4.3`
- `a2a-rs 0.4.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.