CVE-2026-113707

Medium

Description

A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the file a2a-server/src/task_store/inmemory.rs. The manipulation results in race condition. The attack may be performed from remote. The patch is identified as 7050c7d329238539424ee46440e23b91c4825bee. It is advisable to implement a patch to correct this issue.

SeverityMedium

CVSS5.4

Exploit probability—

ProductA2aproject A2a-rs

PublishedOct 21, 2026

First seenOct 21, 2026

Weakness typeCWE-362Race condition

How to fix

Patches

github.com/a2aproject/a2a-rs/pull/126
github.com/a2aproject/a2a-rs/commit/7050c7d329238539424ee46440e23b91c4825bee

Affected products

Product	Affected versions	Fixed in
a2aproject a2a-rs	0.4.0, 0.4.1, 0.4.2, 0.4.3, 0.4.4	—

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.