EUVD-2026-114864
GHSA-33qq-jfxc-p6qp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessEstablish or hijack SSE stream to client
-
ExploitSend unbounded or oversized stream data
-
ExecutionparseSSEStream buffers input without limit
-
ImpactExhaust client memory causing denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource consumption limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires the attacker to control the data delivered into the SSE/event stream consumed by parseSSEStream in sdks/typescript/packages/client/src/transform/sse.ts - i.e. a malicious or compromised AG-UI server, or a position to inject into an established stream - in versions up to 0.0.58. The CVSS PR:L indicates a low-privileged/authorized stream connection is needed rather than fully anonymous access, which limits reach. Impact is confined to availability and is low (VA:L): there is no confidentiality or integrity effect, no user interaction is required, and the only complete fix stated by the vendor is upgrading to the patched release (release/2026-10-30, PR #2627). |
| Impact | This is a genuinely low-priority issue, and the available signals agree rather than conflict. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores only 2.1, driven entirely by a low availability impact (VA:L) with no confidentiality or integrity impact (VC:N/VI:N). The vuln.today decision label is 'monitor,' the lowest actionable tier, consistent with a resource-consumption (CWE-400) denial-of-service bug. There is no CISA KEV listing and no EPSS score was provided in the input, so there is no signal of active or probable exploitation. The only exploitation artifact is a GitHub issue referenced as an 'exploit,' which the input explicitly marks as not verified as working exploit code - so POC availability here is weak and must not be read as active exploitation. The PR:L value means some level of access to the event stream is required; nothing in the signals elevates this beyond a minor availability concern for the affected client SDK. |
| Exploit ScenarioDerived | An attacker who controls or impersonates the server end of an AG-UI SSE connection streams a response that the client's parseSSEStream accumulates without bound (for example a frame declaring or producing a size that is never flushed), driving the client's buffer to grow until memory is exhausted and the process degrades or crashes. A public PoC reference exists (a GitHub issue); it is not verified as working exploit code. Per the CVSS vector this is network-reachable with low attack complexity but requires low-level privileges on the stream. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Nov 01, 2026
Denial of service in the ag-ui TypeScript client SDK (versions up to 0.0.58) where the SSE/protobuf stream parser fails to cap buffered data, so a malicious or compromised AG-UI server can force excessive memory consumption in the consuming client. Exploitation requires control over the data delivered into the event stream and a low-privileged stream connection (CVSS PR:L), confining impact to low availability loss with no confidentiality or integrity effect; a public PoC reference exists but is not verified as working exploit code, and no active exploitation has been reported. Priority signals consistently place this as a low-severity, monitor-level issue.
RemediationAI
Upgrade the ag-ui TypeScript client SDK past 0.0.58 to the patched release published at https://github.com/ag-ui-protocol/ag-ui/releases/tag/release/2026-10-30, which contains commit 9e7b2b00bce215bbf731f1e6094f63812527c432 and PR https://github.com/ag-ui-protocol/ag-ui/pull/2627 introducing the MAX_BUFFER_SIZE stream guard; the vendor states the affected component should be upgraded as the complete fix. No separate workaround is documented in the available sources, so where upgrading is not immediately possible, treat AG-UI servers as untrusted input sources and restrict client stream connections to brokers or agent backends that are themselves trusted, noting that this reduces exposure to hostile streams but does not bound the parser itself. Advisory details are available at https://vuldb.com/vuln/429594 and https://vuldb.com/cve/CVE-2026-120235.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
ag-ui is an event-streaming protocol for agent-to-UI communication; its TypeScript client SDK (sdks/typescript/packages/client/src/transform/) transforms HTTP event streams into typed events, with a Server-Sent Events path in sse.ts (parseSSEStream) and a length-prefixed binary protobuf path in proto.ts. The flaw is a CWE-400 uncontrolled resource consumption condition: the parser accumulates incoming stream data without an effective bound, so a peer that declares or delivers oversized frames can drive unbounded buffer growth in the client process. The upstream fix in PR #2627 introduces a MAX_BUFFER_SIZE limit and a MAX_BUFFER_SIZE guard in the protobuf transform, rejecting a frame on the read that carries an over-limit length prefix (e.g. 0xffffffff) with a 'Protobuf message size exceeded maximum limit' error, cancelling the response body and stopping further reads while still allowing an unbounded total of already-complete messages to be processed. The CVSS 4.0 vector supplied scores this at 2.1 with E:P, while the independently assessed CVSS 3.1 vector is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L.
Know when Ag Ui gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Network-reachable low-complexity flaw in a client stream parser requiring an authorized stream connection (PR:L); impact is availability-only and partial (A:L), with no confidentiality or integrity effect and unchanged scope.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in ag-ui-protocol ag-ui up to 0.0.58. Affected is the function parseSSEStream of the file sdks/typescript/packages/client/src/transform/sse.ts of the component SSE Parser. The manipulation leads to resource consumption. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is 9e7b2b00bce215bbf731f1e6094f63812527c432. The affected component should be upgraded.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Cross-origin information disclosure in the ag-ui TypeScript client: HttpAgent builds the POST run request with the conve
Unbounded memory growth in the AG-UI Rust client's SSE frame parser (crates/ag-ui-client/src/sse.rs, shipped in the ag-u
Denial of service in the ag-ui TypeScript client SDK (versions up to and including 0.0.58) allows a party that controls
Resource exhaustion in the ag-ui Protocol TypeScript client SDK (versions up to and including 0.0.58) allows a hostile o
Improper input validation in the AG-UI protocol SDK transport decoder path affects ag-ui versions up to and including 0.
Unbounded buffering in the Server-Sent Events parser of the AG-UI Community SDK (Kotlin/Java) lets a malicious or man-in
Memory exhaustion in the AG-UI Go community SDK's SSE client allows a remote attacker who controls or can intercept an S
Origin validation errors in the AG-UI TypeScript client SDK (ag-ui 1.0) allow remote, low-privileged attackers who can i
Uncaught exception handling in the A2A middleware of ag-ui-protocol ag-ui (all versions up to 2026-09-07) allows an atta
Incomplete cleanup of per-run state in the ag-ui TypeScript client SDK's FilterToolCallsMiddleware allows disallowed too
Unbounded request-body reads in the ag-ui Java community server SDK (JdkAgentHttpHandler, used by applications that inst
Unbounded memory growth in the ag-ui (AG-UI protocol) C++ community SDK's Server-Sent Events parser lets an attacker who
Exploit-DB