A race condition exists in the TaskManager.saveTaskEvent function of a2aproject a2a-java, which may allow an attacker to manipulate task events. The vulnerability is a concurrency flaw that can lead to inconsistent or corrupted state within the application. The impact is primarily an integrity compromise, as the race condition can cause unintended data modifications. The CVE score of 5.3 indicates a moderate severity, and no additional exploitation metrics are provided.

The vulnerability affects the a2aproject a2a-java component, specifically versions up to and including 1.2.0.Final. The fix is available in release 1.3.0.Final, which incorporates the commit identified by 6b8e1e085c35e970ef0048901cd25850e4791ec2.

The risk is elevated by the fact that the attack may be initiated remotely, implying that an external actor could trigger the race condition without local access. The CVSS score of 5.3 reflects this medium level of risk, while the EPSS score is not available, suggesting no publicly known exploitation patterns. The vulnerability is not listed in CISA's KEV catalog, but the remote initiation possibility warrants cautious treatment. An attacker would likely try to coordinate concurrent requests to TaskManager.saveTaskEvent to induce the race, potentially leading to corrupted task data or unintended side effects. If exploited, this could undermine the integrity of tasks processed by the application, which may cascade into broader system misbehavior.