EUVD-2026-111537
GHSA-42fj-5gr6-hr6m
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege access to submit expressions
-
ExploitCraft function call with excessive/unknown arguments
-
ExecutionResolver processes args without bounds
-
ImpactResource consumption degrades availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the ability to supply function calls/expressions to the data-context Resolver in renderers/web_core/src/v0_9/rendering/data-context.ts; the vulnerable code (prior to PR #2417) validated neither the number nor the names of function-call arguments, so a caller could pass excessive or unknown arguments to drive resource consumption. The CVSS vector's PR:L means some low-level privilege is required (not fully unauthenticated), and impact is limited to availability only (VA:L, no confidentiality or integrity effect). The fix limits realistic abuse by enforcing MAX_FUNCTION_CALL_ARGS and throwing an A2uiExpressionError on unknown arguments; affected versions are a2ui 0.10.0 through 0.10.6. |
| Impact | This is a genuinely low-priority issue, and the signals are consistent rather than conflicting. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L) scores only 2.1: remotely reachable and low-complexity, but requiring low-level privileges (PR:L) and causing only a low availability impact (VA:L) with no confidentiality or integrity effect - appropriate for a CWE-400 resource-consumption bug in a function-call argument path. The vuln.today Decision label is 'monitor', and the E:P (Proof-of-Concept) exploit maturity aligns with the input stating a PoC reference exists but is not verified as working exploit code. This CVE is NOT in CISA KEV and no EPSS score was provided, so there is no evidence of active or widespread exploitation. No signals are in tension here; the low CVSS, the 'monitor' decision, the authenticated prerequisite, and the limited availability-only impact all point to a minor, non-urgent hardening fix rather than a real-world emergency. |
| Exploit ScenarioDerived | An attacker with low-privilege access to submit function calls through the a2ui data-context Resolver sends a function call carrying a large number of (including unknown) arguments that the resolver processes without bounds, driving excessive resource consumption on the rendering side. A public PoC reference exists on the project issue tracker but is not verified as working exploit code, and the CVSS vector indicates this requires low privileges (PR:L) rather than fully unauthenticated access. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 28, 2026
Resource exhaustion in a2ui Web Core versions 0.10.0 through 0.10.6 lets low-privileged remote callers degrade availability by passing excessive or unknown function-call arguments to the data-context Resolver. The resolver in renderers/web_core/src/v0_9/rendering/data-context.ts did not validate argument names or enforce a maximum argument count before PR #2417, which adds MAX_FUNCTION_CALL_ARGS and rejects unknown keys. A public PoC reference exists; it is not verified as working exploit code. No active exploitation is confirmed in the supplied intelligence, and the assigned priority is monitor.
RemediationAI
Apply the vendor patch identified in the supplied data: commit eb314e14fabd29cfb4a74e1202afc4fe2081efa2 from PR https://github.com/a2ui-project/a2ui/pull/2417, or upgrade to a release that includes that commit. The supplied data does not state the first released version containing the fix, so verify the release notes or commit history before relying on a version number. Relevant references are the issue at https://github.com/a2ui-project/a2ui/issues/2384 and the commit and PR links above. No separate workaround is described in the supplied references; the vendor advises applying the patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
a2ui is a rendering project whose web_core renderer handles expressions and function calls through a DataContext resolver. The issue is CWE-400 uncontrolled resource consumption: before the fix, function-call arguments were not checked against the catalog's Zod schemas and no cap limited how many arguments could be supplied, so a caller able to provide expressions could drive resource consumption with availability-only impact. PR #2417 introduces getKnownSchemaKeys and validateFunctionArgs, enforces MAX_FUNCTION_CALL_ARGS, and throws A2uiExpressionError for unknown arguments; the tests cover ZodObject, ZodEffects, union and intersection schemas, and return null for passthrough schemas. The independent CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L vector is consistent with a remote, low-privilege denial-of-service condition that does not affect confidentiality or integrity.
Know when A2Ui gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Resolver is network-reachable (AV:N) and the args path is simple to trigger (AC:L), but submitting function calls needs low privilege (PR:L); impact is availability-only resource consumption (A:L), no C/I effect.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in a2ui-project a2ui up to 0.10.6. This impacts an unknown function of the file renderers/web_core/src/v0_9/rendering/data-context.ts of the component data-context Resolver. Such manipulation leads to resource consumption. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The name of the patch is eb314e14fabd29cfb4a74e1202afc4fe2081efa2. Applying a patch is advised to resolve this issue.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Related Vulnerabilities in a2ui-project a2ui Resource Exhaustion Vulnerabilities
View all 6Server-side request forgery in the a2ui agent SDK's FileResolver (a2ui 0.10.0 through 0.10.7) allows a remote, unauthent
Open redirect in the A2UI web rendering library (a2ui-project a2ui) through version 0.10.7 lets an attacker craft a URL
Resource exhaustion in the a2ui component framework versions 0.9 and 0.9.1 allows remote attackers with low-privilege au
Mass assignment (CWE-915) in the a2ui message-processing component lets an authenticated remote attacker inject arbitrar
Information disclosure in the a2ui agent-to-UI rendering library (versions 0.8, 0.9, and 1.0) lets a caller that can dri
Improper URL validation in A2UI's Image, Video and Audio player components (versions up to and including 0.10.4) lets an
Cross-site scripting in the a2a-chat-canvas markdown rendering component of a2ui (a2ui-project) up to version 0.10.7 all
Exploit-DB