Live › vulnerability › CVE-2026-113707
Go to dashboarda2a-rs, a Rust implementation of the agent-to-agent protocol, has a race condition in InMemoryTaskStore::update in versions up to 0.4.4. The sources do not describe what an attacker gains beyond the race itself.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that run an a2a-rs server with the in-memory task store and expose it to remote callers are the ones to look at. The sources do not say whether the default configuration is affected or what conditions trigger the race.
No product ranges from the sources yet.
a2a-rs in Cargo.lock or the Cargo.toml dependency; versions up to 0.4.4 are affected.a2a-server crate with the in-memory task store (InMemoryTaskStore).a2a-rs past 0.4.4 to a release that includes commit 7050c7d329238539424ee46440e23b91c4825bee; the fixed release number is unknown.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the file a2a-server/src/task_store/inmemory.rs. The manipulation results in race condition. The attack may be performed from remote. The patch is identified as 7050c7d329238539424ee46440e23b91c4825bee. It is advisable to implement a patch to correct this issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-113707")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.