CVE-2026-113707: a2aproject a2a-rs inmemory.rs update race condition
A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the file a2a-server/src/taskstore/inmemory.rs. The manipulation results in race condition. The attack may be performed from remote. The patch is identified as 7050c7d329238539424ee46440e23b91c4825bee. It is advisable to implement a patch to correct this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
a2aproject/a2a-rsto a version that resolves this vulnerability.Patch 7050c7d329238539424ee46440e23b91c4825bee
Event History
Frequently Asked Questions
Which deployments are affected?
a2aproject a2a-rs versions up to and including 0.4.4 are affected. The issue is in InMemoryTaskStore::update in a2a-server/src/task_store/inmemory.rs.
What level of access does an attacker need?
The attack can be performed remotely and requires low privileges. No user interaction is required.
What is the impact of successful exploitation?
Successful exploitation may affect integrity and availability, while no confidentiality impact is identified. The underlying weakness is a race condition in task-store updates.
What remediation is available?
Apply the vendor patch identified by commit 7050c7d329238539424ee46440e23b91c4825bee. The provided information does not specify an alternative mitigation if patching cannot be performed immediately.