PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-113707 a2aproject CVE debrief

A security flaw has been discovered in a2aproject a2a-rs up to 0.4.4. The affected element is the function InMemoryTaskStore::update of the file a2a-server/src/task_store/inmemory.rs. The manipulation results in race condition. The attack may be performed from remote. The patch is identified as 7050c7d329238539424ee46440e23b91c4825bee. This race condition vulnerability in the InMemoryTaskStore::update function of a2a-rs up to 0.4.4 allows remote attackers to potentially exploit the system. Defenders should prioritize patching to prevent potential remote attacks.

Vendor
a2aproject
Product
a2a-rs
CVSS
MEDIUM 5.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-20
Original CVE updated
2026-10-28
Advisory published
2026-10-20
Advisory updated
2026-10-28

Who should care

Defenders responsible for a2a-rs deployments should assess exposure and prioritize patching. They should also verify patch application and monitor for potential remote attacks. Security teams and vulnerability management teams should review the vulnerability and prioritize patching to prevent potential remote attacks.

Why it matters

Defenders should prioritize patching the vulnerable function InMemoryTaskStore::update in a2a-rs versions up to 0.4.4 to prevent potential remote attacks.

  • Verify patch application to prevent potential remote attacks.
  • Assess exposure of a2a-rs versions up to 0.4.4.
  • Monitor for potential remote attacks.

Technical summary

The function InMemoryTaskStore::update in a2a-rs versions up to 0.4.4 is vulnerable to a race condition. The attack may be performed from remote. This vulnerability allows remote attackers to potentially exploit the system by manipulating the update function. Defenders should prioritize patching the vulnerable function to prevent potential remote attacks. The patch 7050c7d329238539424ee46440e23b91c4825bee has been identified as a fix for this issue. The CVE Program and source item provide details on the vulnerability.

Defensive priority

Defenders should prioritize patching the vulnerable function InMemoryTaskStore::update in a2a-rs versions up to 0.4.4.

Recommended defensive actions

  • Patch the vulnerable function InMemoryTaskStore::update in a2a-rs versions up to 0.4.4 with the identified patch 7050c7d329238539424ee46440e23b91c4825bee.
  • Verify the patch has been applied correctly.
  • Monitor for potential remote attacks.
  • Review compensating controls for exposed systems while remediation is scheduled and verified.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability, including the affected function and patch. The vulnerability is a race condition in the InMemoryTaskStore::update function of a2a-rs up to 0.4.4. The patch 7050c7d329238539424ee46440e23b91c4825bee has been identified. Evidence is limited to CVE Program and source item details. Defenders should verify patch application and assess exposure.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-113707 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-113707

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-113707 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-113707

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • a2aproject a2a-rs inmemory.rs update race condition

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/113xxx/CVE-2026-113707.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/vuln/422869

    Supplemental source - vdb-entry, technical-description

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/vuln/422869/cti

    Supplemental source - signature, permissions-required

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/cve/CVE-2026-113707

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://vuldb.com/submit/1015056

    Supplemental source - third-party-advisory

  • Source reference

    Unverified legacy reference

    URL: https://github.com/a2aproject/a2a-rs/pull/126

    Supplemental source - issue-tracking, patch

  • Source reference

    Unverified legacy reference

    URL: https://github.com/a2aproject/a2a-rs/commit/7050c7d329238539424ee46440e23b91c4825bee

    Supplemental source - patch

  • Source reference

    Unverified legacy reference

    URL: https://github.com/a2aproject/a2a-rs/

    Supplemental source - product

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.