EUVD-2026-111578
GHSA-5gqh-669g-4hvg
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low privileges
-
DeliverySubmit oversized or many-part expression template
-
ExploitUnbounded formatString parser consumes excessive resources
-
ExecutionRenderer processing stalls on victim render
-
ImpactAvailability degraded (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires an actor who can supply an expression template string to the a2ui web renderer's formatString function (the FormatStringApi 'value' input), reaching the ExpressionParser.parse path. The triggering inputs are confirmed by the patch: a template whose length exceeds 10,000 UTF-16 code units, or one producing more than 1,000 parsed parts (e.g. '${x}' repeated >1000 times). Limiting factors per the CVSS 4.0 vector: the attacker needs low privileges (PR:L), passive user interaction is required (UI:P) meaning a victim must load/render the malicious expression, and impact is confined to availability (VA:L) with no confidentiality or integrity effect. Affected versions are a2ui 0.10.0 through 0.10.6. |
| Impact | This is a medium-severity availability issue, not a top-priority emergency. The supplied CVSS 4.0 vector (5.1) shows a network-reachable flaw (AV:N) that is low-complexity (AC:L) but requires low privileges (PR:L) and passive user interaction (UI:P), with impact limited to low availability (VA:L) and no confidentiality or integrity impact (VC:N/VI:N). The E:P in the vector and the intelligence both indicate a public PoC reference exists; it is not verified as working exploit code. There is no CISA KEV listing (no active exploitation claimed) and no EPSS score was provided in the input, so widespread-exploitation probability cannot be quantified from available data. The vuln.today decision label is 'this_month', consistent with a real but non-urgent fix window rather than act_now/emergency. Signals are internally consistent: a CWE-400 resource-consumption bug with availability-only impact, gated by authentication and user interaction, is a genuine denial-of-service concern for exposed deployments but does not permit code execution or data compromise. |
| Exploit ScenarioDerived | A low-privileged user able to supply an expression template to the a2ui web renderer submits a crafted value - either an extremely long string or one containing thousands of ${...} interpolation parts - that is passed to the formatString function. When the expression parser processes this input during rendering, the previously unbounded parsing consumes excessive CPU/memory, degrading availability for the victim session that loads it. A public PoC reference exists (GitHub issue #2389); it is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Resource exhaustion in the a2ui web renderer's expression parser affects versions 0.10.0 through 0.10.6: a crafted template string handed to the formatString basic function is parsed without any bound on length or part count, so an attacker who can supply that input can force excessive parsing work in a victim's renderer. The CVSS 4.0 vector requires low privileges (PR:L) and passive user interaction (UI:P) - a victim must load or render the malicious expression - and the resulting impact is limited to availability (VA:L) with no confidentiality or integrity effect. A public PoC reference exists (GitHub issue #2389); it is not verified as working exploit code, there is no CISA KEV listing, and the priority decision is 'this_month' rather than an emergency.
RemediationAI
Apply the upstream fix: pull request https://github.com/a2ui-project/a2ui/pull/2433, commit 1f71d1aac1b145ef57c7526f9e0cff316f5934e2, which adds MAX_EXPRESSION_TEMPLATE_LENGTH = 10,000 and MAX_EXPRESSION_PARTS = 1,000 to ExpressionParser.parse and caps the FormatStringApi 'value' field at the same length; this is an upstream fix available as a PR/commit, and a released patched version number is not independently confirmed, so verify that the build you deploy contains the commit. Until an upgraded build is in place, the practical compensating control is to enforce the same limits before data reaches the renderer - reject or truncate expression templates longer than 10,000 UTF-16 code units and any template that expands to more than 1,000 parsed parts (for example '${x}' repeated more than 1,000 times) in whatever layer supplies formatString input, accepting that legitimately large or heavily interpolated templates will be refused. Treat expression templates from untrusted or low-privileged sources as hostile input, since the assessed vector requires only low privileges plus a victim rendering the malicious expression, and monitor for repeated parser errors indicating oversized templates.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
a2ui is a UI rendering project whose web core ships a TypeScript expression parser (renderers/web_core/src/v0_9/basic_catalog/expressions/expression_parser.ts) used by the basic-catalog formatString function. The parser splits a template string into an output array of parts, where a part is an interpolated expression (${...}), an escaped interpolation delimiter, or a literal text span between interpolations; it previously performed this work over arbitrarily large inputs. That is the CWE-400 uncontrolled resource consumption pattern: the cost of parsing scales with attacker-supplied input and nothing caps it. The upstream fix confirms the trigger precisely by introducing two exported constants, MAX_EXPRESSION_TEMPLATE_LENGTH = 10,000 (measured in UTF-16 code units, i.e. JavaScript string.length) and MAX_EXPRESSION_PARTS = 1,000, and throwing an A2uiExpressionError when either is exceeded; the FormatStringApi 'value' schema was also tightened from z.coerce.string() to z.coerce.string().max(MAX_EXPRESSION_TEMPLATE_LENGTH). The affected code path is the v0_9 basic catalog, reachable when the renderer processes a template through ExpressionParser.parse.
Know when A2Ui gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Network-reachable parser input (AV:N/AC:L) requires a low-privileged submitter (PR:L) and a victim rendering the expression (UI:R); impact is availability-only (A:L), no C/I.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This vulnerability affects the function formatString of the file renderers/web_core/src/v0_9/basic_catalog/expressions/expression_parser.ts of the component Parser. This manipulation causes resource consumption. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: 1f71d1aac1b145ef57c7526f9e0cff316f5934e2. Applying a patch is the recommended action to fix this issue.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in a2ui-project a2ui Resource Exhaustion Vulnerabilities
View all 6Server-side request forgery in the a2ui agent SDK's FileResolver (a2ui 0.10.0 through 0.10.7) allows a remote, unauthent
Open redirect in the A2UI web rendering library (a2ui-project a2ui) through version 0.10.7 lets an attacker craft a URL
Resource exhaustion in the a2ui component framework versions 0.9 and 0.9.1 allows remote attackers with low-privilege au
Mass assignment (CWE-915) in the a2ui message-processing component lets an authenticated remote attacker inject arbitrar
Information disclosure in the a2ui agent-to-UI rendering library (versions 0.8, 0.9, and 1.0) lets a caller that can dri
Improper URL validation in A2UI's Image, Video and Audio player components (versions up to and including 0.10.4) lets an
Cross-site scripting in the a2a-chat-canvas markdown rendering component of a2ui (a2ui-project) up to version 0.10.7 all
Exploit-DB