Description
A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the file a2a-server/src/task_store/inmemory.rs. The manipulation results in race condition. The attack may be performed from remote. The patch is identified as 7050c7d329238539424ee46440e23b91c4825bee. It is advisable to implement a patch to correct this issue.
Published: 2026-10-20
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Race condition potentially leading to remote disruption
Action: Patch Immediately
AI Analysis

Impact

The flaw exists in the InMemoryTaskStore::update function of a2aproject a2a‑rs up to version 0.4.4. It allows a race condition that can be triggered from a remote context and may cause data inconsistency or service instability. Based on the description and the CWE‑362 designation, it is inferred that the race condition may not directly compromise confidentiality or integrity but could impact availability.

Affected Systems

The affected product is a2aproject a2a‑rs, versions up to and including 0.4.4.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity, while an EPSS score of <1% shows a very low chance that the flaw will be actively exploited. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that an attacker might send multiple concurrent requests to trigger the race condition, potentially causing erratic behavior or a denial‑of‑service condition. Although exploitation probability is low, the potential impact on availability warrants timely remediation.

Generated by OpenCVE AI on October 21, 2026 at 16:35 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Apply the patch commit 7050c7d329238539424ee46440e23b91c4825bee or upgrade to a version of a2a‑rs that includes the fix
  • Restrict or temporarily disable remote access to the InMemoryTaskStore::update endpoint until the patch is applied
  • Monitor the service for signs of race‑condition‑driven instability and treat any anomalous task store behavior as a potential exploitation attempt

Generated by OpenCVE AI on October 21, 2026 at 16:35 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 23:45:00 +0000

Type Values Removed Values Added
Description A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the file a2a-server/src/task_store/inmemory.rs. The manipulation results in race condition. The attack may be performed from remote. The patch is identified as 7050c7d329238539424ee46440e23b91c4825bee. It is advisable to implement a patch to correct this issue.
Title a2aproject a2a-rs inmemory.rs update race condition
First Time appeared A2aproject
A2aproject a2a-rs
Weaknesses CWE-362
CPEs cpe:2.3:a:a2aproject:a2a-rs:*:*:*:*:*:*:*:*
Vendors & Products A2aproject
A2aproject a2a-rs
References
Metrics cvssV2_0

{'score': 5.5, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:P/E:ND/RL:OF/RC:C'}

cvssV3_0

{'score': 5.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C'}

cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}

Subscriptions

A2aproject A2a-rs
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-28T14:57:28.380Z

Reserved: 2026-10-20T15:57:23.915Z

Link: CVE-2026-113707

cve-icon Vulnrichment

Updated: 2026-10-28T14:57:16.181Z

cve-icon NVD

Status : Deferred

Published: 2026-10-21T00:17:49.157

Modified: 2026-10-28T15:17:03.667

Link: CVE-2026-113707

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-22T16:00:10Z

Weaknesses
  • CWE-362

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')