AG-UI Go SDK CVE-2026-92361

Exploitation requires the AG-UI Go community SSE client (sdks/community/go/pkg/client/sse/client.go) to establish an SSE connection to an endpoint the attacker controls or can MITM; the attacker then sends a stream that never emits a line-terminating newline, or an oversized single frame, so the client's ReadBytes buffer grows unbounded. Impact is limited to availability (memory exhaustion of the client process) - no data disclosure or modification. Key limiting factor: the victim application must connect to the hostile/compromised endpoint, so risk is concentrated in deployments where the agent backend or transport is untrusted; before the fix there was no configurable frame/line cap.

This is a moderate, availability-only issue whose real-world priority is low. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L) yields 5.3 and correctly reflects a non-catastrophic bug: no confidentiality or integrity impact and only partial availability (VA:L). The root cause, confirmed by the PR #2700 diff, is unbounded buffer growth in the Go SSE client's readStream - bufio.Reader.ReadBytes grows its buffer indefinitely when a peer sends data but never a newline delimiter, exhausting client memory (CWE-400). There is no EPSS score, no CISA KEV listing, and no public exploit code, so this is not under active exploitation. Note a signal to verify: VulDB assigned PR:L, but the actual actor is a malicious or compromised SSE endpoint (or a MITM on the stream) that the Go client connects to - that server needs no credentials on the victim, which argues for PR:N; conversely the victim must initiate a connection to the hostile endpoint, a real limiting precondition not captured in raw CVSS. Also note the description says the fix PR 'awaits acceptance,' which conflicts with the 'Patch: Available from vendor' metadata - the fix may not yet be merged/released. Overall: a legitimate resource-exhaustion hardening fix in a niche library, not an urgent threat.

A Go application embeds the AG-UI community SSE client and connects to an agent backend endpoint. An attacker who controls or MITMs that endpoint returns a Server-Sent Events response that streams bytes without ever sending a line terminator (or an oversized single frame); the client's reader accumulates the data indefinitely, driving memory growth until the client process is exhausted or killed. No public exploit code exists, but the condition is trivial to reproduce (AC:L) and the fix's own test harness demonstrates it with a 'holdingReader' that sends data then blocks.