AG-UI Community SDK CVE-2026-101099

Exploitation requires the AG-UI Kotlin/Java client (HttpAgent / SseEventParser) to consume a Server-Sent Events response from an attacker-controlled or man-in-the-middle-positioned agent endpoint. The client must connect to that endpoint (the trust flows from server to client), and the attacker supplies an oversized SSE wire line or decoded event data payload. What limits exploitation: impact is confined to availability (memory exhaustion) of the client process, with no confidentiality or integrity effect; the attacker must be in a position to serve or intercept the SSE stream; and the pre-patch default has no caps whereas patched deployments can set SseLimits (default 1 MiB/line, 8 MiB/event) to neutralize it.

This is a memory-exhaustion / unbounded-buffering defect (CWE-755) in the SSE parser (SseParser.kt / SseEventParser) of the AG-UI Kotlin/Java Community SDK. The fix in PR #2657 introduces SseLimits that bound each SSE wire line to 1 MiB and each decoded event data payload to 8 MiB - confirming that the pre-patch client buffered SSE lines/events without any size cap, allowing a malicious or MitM agent endpoint to feed an oversized stream and drive the client into out-of-memory / resource exhaustion. This is a reverse-trust availability issue: the vulnerable party is the HTTP client consuming the Server-Sent Events response, not a server. The vendor CVSS 4.0 vector (5.3) scores impact as VA:L only (no confidentiality or integrity), which is consistent with a bounded, non-catastrophic DoS. No EPSS score, no CISA KEV listing, and no public exploit code are provided - status is 'no public exploit identified at time of analysis'. The 'Information Disclosure' tag conflicts with the actual impact profile (VC:N in the vendor vector; the fix is purely about size limits), so that tag appears mislabeled. Real-world risk is modest: it requires the client to connect to an attacker-controlled or intercepted SSE stream, the impact is limited to availability of the client process, and the fix is still an unmerged PR at time of analysis.

An application using the AG-UI Kotlin/Java Community SDK's HttpAgent connects to a remote agent endpoint that is attacker-controlled (or intercepted via MitM). The malicious endpoint returns an SSE response containing an enormous single line or event data payload; because the parser applied no size caps, the client buffers it in memory and exhausts heap, degrading or crashing the consuming process. No public exploit code is identified, but the mitigating patch clearly documents the missing bounds.