CVE-2026-113707
MediumCVSS 5.4Summary
A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the file a2a-server/src/task_store/inmemory.rs. The manipulation results in race condition. The attack may be performed from remote. The patch is identified as 7050c7d329238539424ee46440e23b91c4825bee.
Risk Assessment
A race condition can lead to inconsistent task store state and unpredictable application behavior, which may be exploited to disrupt service availability. Organizations using a2a-rs are exposed to remote destabilizing attacks.
Recommendation
Apply patch 7050c7d329238539424ee46440e23b91c4825bee or upgrade a2a-rs to a version containing this fix. Applying the patch is advisable to remediate the issue.
Other vulnerabilities in a2a-rs
See all- CVE-2026-113706Low
A vulnerability was identified in a2aproject a2a-rs up to 0.4.3. Impacted is an unknown function of the file a2a-server/src/task_store/inmemory.rs. The manipulation of the argument historyLength leads to information disclosure. The attack is possible to be carried out remotely. The identifier of the patch is 68f1b7e772ae5d6c9e581ac9b48bcddd10fe70eb. To fix this issue, it is recommended to deploy a patch.
- CVE-2026-113705Medium
A vulnerability was determined in a2aproject a2a-rs up to 0.4.3. This issue affects some unknown processing of the file a2a-server/src/error.rs. Executing a manipulation can lead to information exposure through error message. The attack can be executed remotely. This patch is called 713b943af94ab2d521d483b841618b97a2e78a4d.
- CVE-2026-113704High
In a2aproject a2a-rs up to 0.4.3, the HttpPushSender function in crates/server/src/push_notification_sender.rs (Push Notification Handler component) allows manipulation of the TaskPushNotificationConfig argument, leading to server-side request forgery. The attack may be launched remotely, and the patch is commit 2ba50176ea9f222d9a7d0f0e8cfe6fae7cf4c224.
Original NVD description (English source)
A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the file a2a-server/src/task_store/inmemory.rs. The manipulation results in race condition. The attack may be performed from remote. The patch is identified as 7050c7d329238539424ee46440e23b91c4825bee. It is advisable to implement a patch to correct this issue.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS