AG-UI Rust Client CVE-2026-92362

Exploitation requires the ag-ui Rust client (crates/ag-ui-client) to open an SSE connection to an endpoint the attacker controls, has compromised, or can machine-in-the-middle; the malicious server then withholds the frame delimiter and streams an unterminated frame that grows the client's read buffer without bound. The limiting factor is that this is a client-side parser flaw - a benign, correctly-behaving server does not trigger it, so an attacker must influence the SSE data source the client consumes rather than reach a listening service directly. Impact is confined to memory/availability of the consuming client process; no authentication or user interaction beyond the client's normal act of connecting to its configured endpoint is required.

This is a genuine but low-severity availability issue, not a high-priority emergency. The CWE-400 flaw lives in the Rust community SDK's SSE frame parser (crates/ag-ui-client/src/sse.rs): the read buffer accumulated bytes while waiting for a frame delimiter (\n\n) with no upper bound, so an SSE source that never sends a delimiter forces unbounded buffer growth toward memory exhaustion - the PR #2500 fix adds an 8 MiB per-frame cap (SSE_MAX_BUFFER_BYTES). The CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, VulDB-scored 6.9) reflects easy remote reachability, but the impact triad VC:L/VI:L/VA:L is poorly calibrated: this is a memory-exhaustion DoS with no plausible confidentiality or integrity effect, so VC:L and VI:L are unjustified and the real impact is availability-only against the client that consumes the stream. Crucially, the 'attacker' is the SSE server side - exploitation requires the ag-ui client to connect to an attacker-controlled, compromised, or MITM'd SSE endpoint, which meaningfully limits real-world risk. No EPSS score, no CISA KEV listing, and no public exploit code are present; SSVC exploitation status is effectively 'none.' Net: a legitimate hardening fix in a niche emerging library, low operational urgency.

An ag-ui Rust client is pointed at an agent/SSE endpoint that an attacker controls or has compromised (or is able to MITM). The malicious server responds with an SSE stream that never emits a frame delimiter, streaming an ever-growing single 'frame'; the client's unbounded String buffer grows until the host runs out of memory and the client process is OOM-killed. No public exploit code is identified at time of analysis; the issue is documented via a VulDB report and a pending upstream patch.