EUVD-2026-111573
GHSA-485f-gc3c-ph93
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach a2ui renderer with untrusted input
-
DeliveryCraft deeply nested dynamic-value expression
-
ExploitSubmit payload for resolution
-
ExecutionTrigger unbounded recursion in DataContext
-
ImpactExhaust call stack / deny service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the deployed application use the a2ui web_core v0_9 renderer to resolve A2UI dynamic-value/function-call expressions originating from an untrusted or remote source; the attacker must be able to supply an expression tree nested beyond the (now-)enforced depth of 1000 to drive DataContext.resolveSignal/resolveDynamicValue into unbounded recursion. Limiting factors: impact is confined to availability (VA:L) of the rendering context (a stack-exhaustion crash/hang), not code execution or data disclosure; deployments that never feed attacker-controlled A2UI payloads into the renderer are not exposed. No special authentication or user interaction is indicated by the vector (PR:N/UI:N). |
| Impact | This is a moderate, availability-only issue, not a top-tier emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes remote, low-complexity, unauthenticated reach with no authentication qualifier needed since PR:N, but the only impact is VA:L - a limited availability/denial-of-service effect (C and I are N). The CWE-400 (uncontrolled resource consumption) classification and the source-code fix are consistent: the DataContext.resolveDynamicValue/resolveSignal/subscribeDynamicValue paths recursed without a depth bound, so a deeply nested dynamic-value or function-call payload could exhaust the JavaScript call stack. The E:P (Proof-of-Concept) exploit maturity aligns with the input stating a PoC reference exists that is not verified as working exploit code. No EPSS score was supplied, and KEV status is not listed (so there is no confirmation of active exploitation). The vuln.today decision label is 'this_month', indicating a plan-and-patch urgency rather than act_now/emergency. Net: signals are internally consistent and point to a real but bounded DoS against applications that render untrusted A2UI expression payloads; impact is confined to the availability of the rendering context rather than full system compromise. |
| Exploit ScenarioDerived | An application embeds the a2ui web_core renderer and processes A2UI documents supplied by a remote or untrusted party. The attacker submits a dynamic-value payload with more than 1000 levels of nested function-call/args wrapping; when DataContext resolves it, unbounded recursion exhausts the call stack and crashes or hangs the rendering context. A public PoC reference exists (GitHub issue #2388) but is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Unbounded recursion in the a2ui web_core v0_9 renderer (DataContext.resolveSignal / resolveDynamicValue) lets a remote attacker who can supply A2UI dynamic-value or function-call expression trees crash or hang the rendering context through call-stack exhaustion, an availability-only denial of service. All versions listed through 0.10.6 (EUVD enumerates 0.10.0 through 0.10.6) are affected; the CVSS 4.0 score is 6.9 with VA:L only, and the project's own assessed vector (CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) confirms no confidentiality or integrity impact and no authentication or user interaction requirement. A public PoC reference exists in issue #2388; it is not verified as working exploit code, and there is no KEV listing, so this is a moderate, availability-only issue rather than a top-tier emergency, prioritized as 'this_month' by vuln.today. A vendor fix is available as PR #2432 / commit c76e17272e52c12c6dcf68905b1df978c39e9aa5, which introduces a MAX_DYNAMIC_VALUE_DEPTH guard of 1000.
RemediationAI
Vendor-released patch: upstream fix commit c76e17272e52c12c6dcf68905b1df978c39e9aa5 (pull request https://github.com/a2ui-project/a2ui/pull/2432) adds the MAX_DYNAMIC_VALUE_DEPTH = 1000 recursion guard to data-context.ts; upgrade the a2ui web_core package to a build that contains this commit - no later fixed release version number is stated in the available data, so confirm the exact version against the upstream repository or the VulDB advisory at https://vuldb.com/vuln/427573 before closing the finding. Because the defect lives in the expression resolver rather than in a network service, there is no port or endpoint to block; the practical compensating control is to stop routing untrusted or remote-supplied A2UI dynamic-value/function-call expression trees into the v0_9 renderer until the patched build is deployed - validate payloads so that deeply nested {call: ...} structures are rejected before binding, or restrict rendering to server-generated, developer-authored expressions, accepting the functional limitation that user- or tenant-supplied dynamic expressions will no longer render. If a fork or vendored copy is in use, backport the depth parameter and limit check into resolveDynamicValue and resolveSignal, including the array and argument recursion sites. Note that a public PoC reference exists in issue #2388 (not verified as working exploit code), so the depth limit should be treated as the definitive fix rather than relying on the payload being hard to construct.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
a2ui is a project providing a declarative UI framework whose TypeScript 'web_core' package renders A2UI payloads; in the v0_9 renderer, data-context.ts implements DataContext, which resolves 'DynamicValue' structures that may contain nested function calls ({call: 'name', args: {...}}) and paths. Both resolveDynamicValue() and resolveSignal() walk these structures recursively, and the generic-binder.ts layer binds resolved signals into the UI. Because the walk had no depth accounting, an expression tree nested beyond the engine's stack capacity drove unbounded recursion and blew the JavaScript call stack, matching CWE-400 (Uncontrolled Resource Consumption) rather than memory-exhaustion or code-execution classes. The upstream patch adds an exported MAX_DYNAMIC_VALUE_DEPTH constant (1000) and threads a depth parameter through resolveDynamicValue, resolveSignal and the array/argument recursion points, dispatching an A2uiExpressionError ('Maximum dynamic value nesting depth exceeded') and returning undefined (or an undefined-valued signal) once the limit is exceeded; accompanying tests confirm legitimate nesting within the limit (e.g. five nested calls) still evaluates correctly while a payload of MAX_DYNAMIC_VALUE_DEPTH + 10 nested calls is rejected. The CPE cpe:2.3:a:a2ui-project:a2ui:*:*:*:*:*:*:*:* and EUVD's affected list (0.10.0, 0.10.1, 0.10.2, 0.10.3, 0.10.4, 0.10.5, 0.10.6) show this is a library-level flaw inherited by any application embedding the renderer.
Know when A2Ui gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Remote, low-complexity, unauthenticated resolution of nested expressions (AV:N/AC:L/PR:N/UI:N); only a partial denial-of-service via stack exhaustion, so C:N/I:N/A:L and scope unchanged.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
2DescriptionCVE.org
A vulnerability was found in a2ui-project a2ui up to 0.10.6. This affects the function DataContext.resolveSignal of the file renderers/web_core/src/v0_9/rendering/data-context.ts of the component Resolver. The manipulation results in resource consumption. The attack can be launched remotely. The exploit has been made public and could be used. The patch is identified as c76e17272e52c12c6dcf68905b1df978c39e9aa5. It is advisable to implement a patch to correct this issue.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in a2ui-project a2ui Resource Exhaustion Vulnerabilities
View all 6Server-side request forgery in the a2ui agent SDK's FileResolver (a2ui 0.10.0 through 0.10.7) allows a remote, unauthent
Open redirect in the A2UI web rendering library (a2ui-project a2ui) through version 0.10.7 lets an attacker craft a URL
Resource exhaustion in the a2ui component framework versions 0.9 and 0.9.1 allows remote attackers with low-privilege au
Mass assignment (CWE-915) in the a2ui message-processing component lets an authenticated remote attacker inject arbitrar
Information disclosure in the a2ui agent-to-UI rendering library (versions 0.8, 0.9, and 1.0) lets a caller that can dri
Improper URL validation in A2UI's Image, Video and Audio player components (versions up to and including 0.10.4) lets an
Cross-site scripting in the a2a-chat-canvas markdown rendering component of a2ui (a2ui-project) up to version 0.10.7 all
Exploit-DB