A2A Js
Monthly
Race condition in the a2a-js Task Status Update Handler (versions 1.0 and 1.1.0) lets a remote caller have a task cancellation overwrite a status written by a concurrently finishing executor - or have the CANCELED write lost - corrupting the persisted task record. The window exists because cancelTask on the no-event-bus path of DefaultRequestHandler performs load→check→mutate→save without taking the per-(tenant, owner, taskId) write lock or checking whether the task has already reached a terminal state. Impact is confined to task integrity and availability (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/C:N/I:L/A:L); exploitation is non-deterministic, requiring a narrow timing race against the executor's completion, and no public exploit code was identified at time of analysis. Rated this_month priority - a medium-severity integrity/availability issue rather than an emergency.
Race condition in the a2a-js Task Status Update Handler (versions 1.0 and 1.1.0) lets a remote caller have a task cancellation overwrite a status written by a concurrently finishing executor - or have the CANCELED write lost - corrupting the persisted task record. The window exists because cancelTask on the no-event-bus path of DefaultRequestHandler performs load→check→mutate→save without taking the per-(tenant, owner, taskId) write lock or checking whether the task has already reached a terminal state. Impact is confined to task integrity and availability (CVSS 3.1 AV:N/AC:H/PR:N/UI:N/C:N/I:L/A:L); exploitation is non-deterministic, requiring a narrow timing race against the executor's completion, and no public exploit code was identified at time of analysis. Rated this_month priority - a medium-severity integrity/availability issue rather than an emergency.