EUVD-2026-111567
GHSA-hp6r-frq8-9pmp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain write access to bound data model
-
ExploitPoint dynamic ChildList template at oversized array
-
ExecutionRenderer materializes unbounded child nodes
-
ImpactExhaust client rendering resources
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The flaw is reachable only when an application uses a dynamic ChildList template - a component whose children are declared as {componentId, path} bound to a data-model array (e.g. Column with children bound to /items) - AND an attacker can cause that bound array to become very large. Pre-patch there was no size cap, so a 12,000+ element array produced that many materialized child nodes. Limiting factors: exploitation requires privilege to write/influence the bound data model (PR:L, so not fully unauthenticated), no user interaction (UI:N), and the impact is confined to low availability (VA:L) degradation of the client-side web renderer with no confidentiality or integrity effect; applications that do not use data-bound dynamic ChildLists are not exposed. |
| Impact | All signals converge on low real-world priority. The supplied CVSS 4.0 base score is 2.1 (Low): AV:N and AC:L make it remotely reachable with low complexity, but the only impact is VA:L (low availability) with VC:N/VI:N - no confidentiality or integrity loss and no scope change - and PR:L means the attacker must already have some privilege to influence the bound data. The vuln.today decision label is 'monitor', consistent with this. No EPSS score and no CISA KEV entry are present in the input, so there is no evidence of active or widespread exploitation; a public PoC reference exists (GitHub issue #2387) but it is not verified as working exploit code. The source diff confirms the mechanism is a client-side resource-consumption flaw (CWE-400) in a UI renderer, not a server-crashing or RCE condition. This is a genuine but minor hardening issue, not an emergency - there is no conflict among the signals, all of which point to low urgency with a patch already available. |
| Exploit ScenarioDerived | An attacker who can influence the A2UI data model points a dynamic ChildList template (a component whose children are defined as {componentId, path} bound to a data array) at an extremely large array - the reference issue uses 12,000-15,000 items. Before the fix the renderer materialized one child node per array element with no cap, so the oversized array drives unbounded memory and CPU use in the client rendering surface, degrading or hanging it. A public PoC reference exists; it is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Unbounded resource consumption in the a2ui web_core renderer (versions 0.10.0 through 0.10.6) lets an attacker who can influence a data-bound dynamic ChildList force the client to materialize an arbitrarily large number of child nodes. The flaw sits in the GenericBinder path of renderers/web_core/src/v0_9/rendering/generic-binder.ts, which pre-patch applied no size cap when expanding a {componentId, path} children binding into one node per array element; a 12,000-element array produced 12,000 nodes in the reference test. Exploitation requires write access to the bound data model (authenticated, PR:L per the assessed vector), causes only low availability degradation of the browser-side renderer with no confidentiality or integrity impact, and a public PoC reference exists on the upstream issue tracker although it is not verified as working exploit code. Priority signals are uniformly low (vuln.today decision: monitor), so this is a hardening item rather than an urgent patch.
RemediationAI
Vendor-released patch: upstream fix commit c97f4a02d3fea33ce3e9de5cf3fd0e3b8f3a4f0e (pull request https://github.com/a2ui-project/a2ui/pull/2431); a tagged release carrying it is not independently confirmed in the available data, so track the repository at https://github.com/a2ui-project/a2ui/ and upgrade the web_core renderer as soon as a build containing that commit is published. The fix caps dynamic ChildList materialization at MAX_DYNAMIC_CHILD_LIST_SIZE (10,000) and routes non-array input to an empty list. If upgrading immediately is not possible, the effective compensating control is application-side: clamp or validate the length of any array bound to a {componentId, path} children template before it reaches the renderer (truncate to a few thousand entries or paginate/virtualize the list), with the side effect that legitimately large lists will render truncated until the patch is applied. Deployments that do not use data-bound dynamic ChildLists require no immediate action beyond normal upgrade cadence.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
a2ui is a renderer/UI framework whose web_core package (TypeScript) binds abstract component models to a client-side data model. CWE-400 (Uncontrolled Resource Consumption) arises because dynamic ChildList templates - a component such as Column whose children are declared as an object of the form {componentId, path}, pointing at an array in the data model - were expanded one-to-one into materialized ComponentNode objects with no upper bound. GenericBinder in generic-binder.ts performed that expansion, and NodeResolver in node-resolver.ts mirrored it when resolving the node graph, so a large bound array caused proportional memory allocation and render work in the client. The upstream fix introduces an exported constant MAX_DYNAMIC_CHILD_LIST_SIZE = 10,000 plus a getSafeChildList() helper that rejects non-array/nullish input and slices oversized arrays, and wires the helper into both GenericBinder and NodeResolver; accompanying tests confirm a 12,000- and 15,000-element list is truncated to the cap. The affected code path is the v0_9 renderer lineage, i.e. the 0.10.x release series, and only applications that actually use data-bound dynamic ChildLists are exposed.
Know when A2Ui gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Remotely reachable renderer (AV:N/AC:L) but influencing the bound data model needs privilege (PR:L); only low availability impact (A:L) from client-side resource exhaustion, with no confidentiality or integrity impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability has been found in a2ui-project a2ui up to 0.10.6. Affected by this issue is some unknown functionality of the file renderers/web_core/src/v0_9/rendering/generic-binder.ts of the component Binder. The manipulation leads to resource consumption. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is c97f4a02d3fea33ce3e9de5cf3fd0e3b8f3a4f0e. To fix this issue, it is recommended to deploy a patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in a2ui-project a2ui Resource Exhaustion Vulnerabilities
View all 6Server-side request forgery in the a2ui agent SDK's FileResolver (a2ui 0.10.0 through 0.10.7) allows a remote, unauthent
Open redirect in the A2UI web rendering library (a2ui-project a2ui) through version 0.10.7 lets an attacker craft a URL
Resource exhaustion in the a2ui component framework versions 0.9 and 0.9.1 allows remote attackers with low-privilege au
Mass assignment (CWE-915) in the a2ui message-processing component lets an authenticated remote attacker inject arbitrar
Information disclosure in the a2ui agent-to-UI rendering library (versions 0.8, 0.9, and 1.0) lets a caller that can dri
Improper URL validation in A2UI's Image, Video and Audio player components (versions up to and including 0.10.4) lets an
Cross-site scripting in the a2a-chat-canvas markdown rendering component of a2ui (a2ui-project) up to version 0.10.7 all
Exploit-DB