Ag Ui
Monthly
Unbounded memory growth in the ag-ui (AG-UI protocol) C++ community SDK's Server-Sent Events parser lets an attacker who can control or influence the consumed SSE stream exhaust the parsing process's memory, producing a denial of service. The flaw lives in sdks/community/c++/src/stream/sse_parser.cpp, where the buffer guard compares only m_buffer plus the incoming chunk against kMaxBufferSize and ignores the per-event accumulator m_currentData, so a single event that is never terminated by a blank line and delivered as many small chunks grows without bound. It is rated CVSS 5.3 (CVSS:4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L) / CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, availability-only and requiring the low-privilege, authorized position of the stream producer; no public exploit identified at time of analysis, and an upstream fix is available (commit ab6e0bc, PR #2501).
Unbounded memory growth in the AG-UI Rust client's SSE frame parser (crates/ag-ui-client/src/sse.rs, shipped in the ag-ui 1.0 community SDK) lets a malicious, compromised, or machine-in-the-middle SSE server exhaust the memory of the consuming client process by streaming a frame it never terminates with a blank-line delimiter. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV), but the outcome is a denial of service confined to the client process, matching the independently assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L rather than the higher CVSS 4.0 score of 6.9. Exploitation requires the Rust client to open an SSE connection to an endpoint that the attacker controls, has compromised, or can intercept; a correctly behaving server never triggers the flaw, so this is a client-side parsing weakness rather than a remotely reachable listening service.
Memory exhaustion in the AG-UI Go community SDK's SSE client allows a remote attacker who controls or can intercept an SSE endpoint to drive the client process out of memory by sending a stream that never terminates a line, or an oversized single frame. The affected component is sdks/community/go/pkg/client/sse/client.go in ag-ui, and impact is availability-only with no data disclosure or modification, consistent with the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. No public exploit was identified at time of analysis; an upstream fix exists as pull request #2700 but a released patched version is not independently confirmed.
Origin validation errors in the AG-UI TypeScript client SDK (ag-ui 1.0) allow remote, low-privileged attackers who can influence an agent event stream to bypass event-origin checks and release the pending-interrupt gate, yielding low confidentiality, integrity, and availability impact. Affected deployments are those consuming untrusted or compromised AG-UI event sources; the advisory describes manipulation of the TEXT_MESSAGE_START argument, while the upstream fix PR #2701 also addresses an interrupt/resume state flaw where a stream emits an interrupt outcome and then finishes a subsequent run without a resume. Independent assessment rates this medium severity (vendor CVSS 4.0 base 5.3) with no signals of elevated real-world risk; no public exploit identified at time of analysis, and no CISA KEV entry.
A permissive cross-origin resource sharing (CORS) misconfiguration in the AG-UI aws-strands Python integration (ag-ui 0.3.0) allows a remote, unauthenticated attacker who convinces a victim to load an attacker-controlled web page to issue cross-origin requests against a deployed agent endpoint and read limited response data. The flaw is confined to deployments that bootstrap a FastAPI app via create_strands_app in integrations/aws-strands/python/src/ag_ui_strands/utils.py, where the helper installs wildcard CORS (any origin, method, and header) and mounts the agent route with no authentication dependency; deployments that supply an explicit origins allowlist, set cors_enabled=False, or attach an auth dependency are not affected. Exploitation is rated high complexity and difficult (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N, CVSS 4.0 base 2.3), the impact is limited to low confidentiality loss with no integrity or availability effect, and the browser prohibition on combining wildcard origins with credentialed requests further constrains what a successful attack can expose. No confirmed active exploitation (no CISA KEV listing) and no public exploit code were identified at time of analysis, and no EPSS score was provided in the source data.
Unbounded memory growth in the ag-ui (AG-UI protocol) C++ community SDK's Server-Sent Events parser lets an attacker who can control or influence the consumed SSE stream exhaust the parsing process's memory, producing a denial of service. The flaw lives in sdks/community/c++/src/stream/sse_parser.cpp, where the buffer guard compares only m_buffer plus the incoming chunk against kMaxBufferSize and ignores the per-event accumulator m_currentData, so a single event that is never terminated by a blank line and delivered as many small chunks grows without bound. It is rated CVSS 5.3 (CVSS:4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L) / CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, availability-only and requiring the low-privilege, authorized position of the stream producer; no public exploit identified at time of analysis, and an upstream fix is available (commit ab6e0bc, PR #2501).
Unbounded memory growth in the AG-UI Rust client's SSE frame parser (crates/ag-ui-client/src/sse.rs, shipped in the ag-ui 1.0 community SDK) lets a malicious, compromised, or machine-in-the-middle SSE server exhaust the memory of the consuming client process by streaming a frame it never terminates with a blank-line delimiter. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV), but the outcome is a denial of service confined to the client process, matching the independently assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L rather than the higher CVSS 4.0 score of 6.9. Exploitation requires the Rust client to open an SSE connection to an endpoint that the attacker controls, has compromised, or can intercept; a correctly behaving server never triggers the flaw, so this is a client-side parsing weakness rather than a remotely reachable listening service.
Memory exhaustion in the AG-UI Go community SDK's SSE client allows a remote attacker who controls or can intercept an SSE endpoint to drive the client process out of memory by sending a stream that never terminates a line, or an oversized single frame. The affected component is sdks/community/go/pkg/client/sse/client.go in ag-ui, and impact is availability-only with no data disclosure or modification, consistent with the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. No public exploit was identified at time of analysis; an upstream fix exists as pull request #2700 but a released patched version is not independently confirmed.
Origin validation errors in the AG-UI TypeScript client SDK (ag-ui 1.0) allow remote, low-privileged attackers who can influence an agent event stream to bypass event-origin checks and release the pending-interrupt gate, yielding low confidentiality, integrity, and availability impact. Affected deployments are those consuming untrusted or compromised AG-UI event sources; the advisory describes manipulation of the TEXT_MESSAGE_START argument, while the upstream fix PR #2701 also addresses an interrupt/resume state flaw where a stream emits an interrupt outcome and then finishes a subsequent run without a resume. Independent assessment rates this medium severity (vendor CVSS 4.0 base 5.3) with no signals of elevated real-world risk; no public exploit identified at time of analysis, and no CISA KEV entry.
A permissive cross-origin resource sharing (CORS) misconfiguration in the AG-UI aws-strands Python integration (ag-ui 0.3.0) allows a remote, unauthenticated attacker who convinces a victim to load an attacker-controlled web page to issue cross-origin requests against a deployed agent endpoint and read limited response data. The flaw is confined to deployments that bootstrap a FastAPI app via create_strands_app in integrations/aws-strands/python/src/ag_ui_strands/utils.py, where the helper installs wildcard CORS (any origin, method, and header) and mounts the agent route with no authentication dependency; deployments that supply an explicit origins allowlist, set cors_enabled=False, or attach an auth dependency are not affected. Exploitation is rated high complexity and difficult (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N, CVSS 4.0 base 2.3), the impact is limited to low confidentiality loss with no integrity or availability effect, and the browser prohibition on combining wildcard origins with credentialed requests further constrains what a successful attack can expose. No confirmed active exploitation (no CISA KEV listing) and no public exploit code were identified at time of analysis, and no EPSS score was provided in the source data.