Description
A vulnerability has been found in a2aproject a2a-js up to 1.1.0. Impacted is the function ResultManager.applyStatusUpdate of the file src/server/result_manager.ts of the component Task Status Update Handler. Such manipulation leads to race condition. The attack may be launched remotely. Upgrading to version 1.2.0 is recommended to address this issue. The name of the patch is 7b87c9480bfa643f9d2b2eaf06988b3d3a95de25. It is recommended to upgrade the affected component.
Published: 2026-10-27
Score: 6.9 Medium
EPSS: n/a
KEV: No
Impact: Race Condition Vulnerability
Action: Apply Patch
AI Analysis

Impact

The vulnerability exists in the ResultManager.applyStatusUpdate function of the a2a-js Task Status Update Handler. It creates a race condition that an attacker could manipulate remotely, potentially leading to inconsistent task status updates or a denial of service. The flaw is classified as concurrency unsafe (CWE‑362).

Affected Systems

The affected component is a2aproject a2a‑js. All releases up to version 1.1.0 are vulnerable; upgrading to v1.2.0 removes the flaw.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity. No EPSS data is available and the flaw is not listed in the CISA KEV catalog, but the possibility of a remote attack path increases the risk profile. An authenticated or unauthenticated remote client that can trigger applyStatusUpdate concurrently may exploit the race to influence application logic.

Generated by OpenCVE AI on October 27, 2026 at 23:57 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Update a2a‑js to version 1.2.0 or later to remove the race condition.
  • Restrict concurrent calls to the ResultManager.applyStatusUpdate endpoint while the upgrade is pending, for example by adding request throttling or an application‑level lock.
  • If custom logic interacts with ResultManager.applyStatusUpdate, review that code and add proper synchronization such as mutexes or atomic operations to prevent concurrent modification issues.

Generated by OpenCVE AI on October 27, 2026 at 23:57 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 27 Oct 2026 22:30:00 +0000

Type Values Removed Values Added
Description A vulnerability has been found in a2aproject a2a-js up to 1.1.0. Impacted is the function ResultManager.applyStatusUpdate of the file src/server/result_manager.ts of the component Task Status Update Handler. Such manipulation leads to race condition. The attack may be launched remotely. Upgrading to version 1.2.0 is recommended to address this issue. The name of the patch is 7b87c9480bfa643f9d2b2eaf06988b3d3a95de25. It is recommended to upgrade the affected component.
Title a2aproject a2a-js Task Status Update result_manager.ts ResultManager.applyStatusUpdate race condition
First Time appeared A2aproject
A2aproject a2a-js
Weaknesses CWE-362
CPEs cpe:2.3:a:a2aproject:a2a-js:*:*:*:*:*:*:*:*
Vendors & Products A2aproject
A2aproject a2a-js
References
Metrics cvssV2_0

{'score': 6.4, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:P/E:ND/RL:OF/RC:C'}

cvssV3_0

{'score': 6.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C'}

cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C'}

cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}

Subscriptions

A2aproject A2a-js
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-27T22:15:19.102Z

Reserved: 2026-10-27T16:46:21.253Z

Link: CVE-2026-118128

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-27T23:16:58.687

Modified: 2026-10-27T23:16:58.687

Link: CVE-2026-118128

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-28T00:00:22Z

Weaknesses
  • CWE-362

    Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')