Ag Ui
Monthly
Denial of service in the ag-ui TypeScript client SDK (versions up to and including 0.0.58) allows a party that controls the interrupt/event producer to permanently wedge a conversation thread by emitting one or more Interrupt objects that omit the expiresAt field. isInterruptExpired treats a missing expiresAt as 'never expires', and the client's resume-coverage check requires every pending interrupt to be addressed before the thread can run again, so the thread stays blocked; before the fix there was also no cap on how many pending interrupts were tracked per thread. No public exploit code has been confirmed (a public PoC reference exists; it is not verified as working exploit code), CVE is not in CISA KEV, and impact is availability-only with no data exposure or modification.
Improper input validation in the AG-UI protocol SDK transport decoder path affects ag-ui versions up to and including 0.0.58, allowing crafted event content to be parsed without proper text handling and producing limited confidentiality, integrity and availability impact. The attack is remote and requires low-level privileges (PR:L with no user interaction), meaning the attacker must be an authorized participant able to submit events over an AG-UI transport rather than an anonymous internet user. A public PoC reference exists (GitHub issue 2524) but it is not verified as working exploit code, and the vendor fix is available in 0.0.59 via commit 660182b973a44b8eda5484b14b88eb9cc251edc4.
Denial of service in the ag-ui TypeScript client SDK (versions up to 0.0.58) where the SSE/protobuf stream parser fails to cap buffered data, so a malicious or compromised AG-UI server can force excessive memory consumption in the consuming client. Exploitation requires control over the data delivered into the event stream and a low-privileged stream connection (CVSS PR:L), confining impact to low availability loss with no confidentiality or integrity effect; a public PoC reference exists but is not verified as working exploit code, and no active exploitation has been reported. Priority signals consistently place this as a low-severity, monitor-level issue.
Resource exhaustion in the ag-ui Protocol TypeScript client SDK (versions up to and including 0.0.58) allows a hostile or compromised HTTP endpoint to force the client process to buffer an unbounded error-response body, degrading availability of that client. The flaw sits in the HTTP Transport error path of runHttpRequest, which read non-success response bodies in full with no size limit, so an attacker who controls, has compromised, or can man-in-the-middle the server the client talks to can return an oversized or never-ending body on a non-2xx status and exhaust process memory. Impact is availability-only for the initiating client - no data disclosure or modification - and a public PoC reference exists (GitHub issue 2521); it is not verified as working exploit code. An upstream fix is proposed in pull request 2698 but is not yet merged or released, and the current assessment rates this as a medium-severity, availability-only issue rather than a top-priority emergency.
Cross-origin information disclosure in the ag-ui TypeScript client: HttpAgent builds the POST run request with the conversation payload and the developer's Authorization/Bearer headers, and in versions up to and including 0.0.58 it left fetch's redirect policy at its default, so a redirect served by the configured endpoint (or injected by a man-in-the-middle on that path) causes that request to be re-issued at another origin, leaking its contents. Exploitation therefore requires control of the upstream endpoint or the network path, not merely the ability to reach a well-behaved TLS endpoint; the CVSS 4.0 vector scores it 6.9 with PR:N, VC:L, and E:P. A public PoC reference exists (issue #2520); it is not verified as working exploit code, and there is no CISA KEV listing. The upstream fix is PR #2575, which pins redirect to "error".
Uncaught exception handling in the A2A middleware of ag-ui-protocol ag-ui (all versions up to 2026-09-07) allows an attacker who can control the arguments of a tool call to crash or permanently hang an agent run stream. Supplying malformed JSON, or valid JSON that is not a usable object (null, a bare number, a string, or an array), reaches an unguarded JSON.parse path in the middleware's conversion logic and throws before any error-catching exists, leaving the run neither completed nor errored. The issue is network-reachable but requires low-level/authenticated privilege to inject the crafted tool-call arguments (CVSS 4.0 base 5.3, PR:L; independent assessment CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L), and impact is limited to availability of the affected run with no confidentiality or integrity effect. There is no public exploit identified at time of analysis; the vendor fixed the flaw in release 2026-09-08.
Incomplete cleanup of per-run state in the ag-ui TypeScript client SDK's FilterToolCallsMiddleware allows disallowed tool-call events from one agent run to escape filtering - or valid events from another run to be wrongly blocked - when a single middleware instance or subscription serves more than one run. Affected deployments are those using ag-ui (ag-ui-protocol) client SDK builds up to 2026-09-07 that rely on FilterToolCallsMiddleware with a disallowedToolCalls list as a real security control, in a pattern where runs overlap, stall, or reuse runId/toolCallId values. The issue is rated CVSS 4.0 5.3 (assessed as CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L) - an authenticated, low-privileged party who can start agent runs is the relevant actor; impact is bounded to filter bypass and mis-blocking rather than code execution, and no public exploit identified at time of analysis. Vendor-released patch: 2026-09-08.
Unbounded buffering in the Server-Sent Events parser of the AG-UI Community SDK (Kotlin/Java) lets a malicious or man-in-the-middle-positioned agent endpoint drive a client-side memory exhaustion condition, degrading or killing the consuming process. All ag-ui-protocol ag-ui builds up to 2026-09-23 are flagged by CPE, specifically the Kotlin Community SDK SseParser.kt and its Java counterpart SseEventParser, which had no per-line or per-event size caps before the fix. Impact is availability-only (no confidentiality or integrity effect), an upstream fix exists as PR #2657 but was still awaiting acceptance, and no public exploit was identified at time of analysis.
Unbounded request-body reads in the ag-ui Java community server SDK (JdkAgentHttpHandler, used by applications that instantiate the two-argument handler constructors) allow a remote attacker to exhaust server heap memory by posting an oversized body - or a chunked body without a Content-Length header - to the agent context path, causing a denial of service. The issue affects ag-ui releases up to 2026-09-23 and is rated low-to-moderate (CVSS 4.0 base 5.3; our independent assessment CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), with impact confined to availability and no confidentiality or integrity effect. No public exploit code or confirmed active exploitation was identified at time of analysis, and the handler's lack of built-in authentication means the practical privilege requirement depends on how each deployment fronts the endpoint; an upstream fix exists as pull request #2671 but is not yet merged/accepted.
Unbounded memory growth in the ag-ui (AG-UI protocol) C++ community SDK's Server-Sent Events parser lets an attacker who can control or influence the consumed SSE stream exhaust the parsing process's memory, producing a denial of service. The flaw lives in sdks/community/c++/src/stream/sse_parser.cpp, where the buffer guard compares only m_buffer plus the incoming chunk against kMaxBufferSize and ignores the per-event accumulator m_currentData, so a single event that is never terminated by a blank line and delivered as many small chunks grows without bound. It is rated CVSS 5.3 (CVSS:4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L) / CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, availability-only and requiring the low-privilege, authorized position of the stream producer; no public exploit identified at time of analysis, and an upstream fix is available (commit ab6e0bc, PR #2501).
Unbounded memory growth in the AG-UI Rust client's SSE frame parser (crates/ag-ui-client/src/sse.rs, shipped in the ag-ui 1.0 community SDK) lets a malicious, compromised, or machine-in-the-middle SSE server exhaust the memory of the consuming client process by streaming a frame it never terminates with a blank-line delimiter. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV), but the outcome is a denial of service confined to the client process, matching the independently assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L rather than the higher CVSS 4.0 score of 6.9. Exploitation requires the Rust client to open an SSE connection to an endpoint that the attacker controls, has compromised, or can intercept; a correctly behaving server never triggers the flaw, so this is a client-side parsing weakness rather than a remotely reachable listening service.
Memory exhaustion in the AG-UI Go community SDK's SSE client allows a remote attacker who controls or can intercept an SSE endpoint to drive the client process out of memory by sending a stream that never terminates a line, or an oversized single frame. The affected component is sdks/community/go/pkg/client/sse/client.go in ag-ui, and impact is availability-only with no data disclosure or modification, consistent with the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. No public exploit was identified at time of analysis; an upstream fix exists as pull request #2700 but a released patched version is not independently confirmed.
Origin validation errors in the AG-UI TypeScript client SDK (ag-ui 1.0) allow remote, low-privileged attackers who can influence an agent event stream to bypass event-origin checks and release the pending-interrupt gate, yielding low confidentiality, integrity, and availability impact. Affected deployments are those consuming untrusted or compromised AG-UI event sources; the advisory describes manipulation of the TEXT_MESSAGE_START argument, while the upstream fix PR #2701 also addresses an interrupt/resume state flaw where a stream emits an interrupt outcome and then finishes a subsequent run without a resume. Independent assessment rates this medium severity (vendor CVSS 4.0 base 5.3) with no signals of elevated real-world risk; no public exploit identified at time of analysis, and no CISA KEV entry.
A permissive cross-origin resource sharing (CORS) misconfiguration in the AG-UI aws-strands Python integration (ag-ui 0.3.0) allows a remote, unauthenticated attacker who convinces a victim to load an attacker-controlled web page to issue cross-origin requests against a deployed agent endpoint and read limited response data. The flaw is confined to deployments that bootstrap a FastAPI app via create_strands_app in integrations/aws-strands/python/src/ag_ui_strands/utils.py, where the helper installs wildcard CORS (any origin, method, and header) and mounts the agent route with no authentication dependency; deployments that supply an explicit origins allowlist, set cors_enabled=False, or attach an auth dependency are not affected. Exploitation is rated high complexity and difficult (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N, CVSS 4.0 base 2.3), the impact is limited to low confidentiality loss with no integrity or availability effect, and the browser prohibition on combining wildcard origins with credentialed requests further constrains what a successful attack can expose. No confirmed active exploitation (no CISA KEV listing) and no public exploit code were identified at time of analysis, and no EPSS score was provided in the source data.
Denial of service in the ag-ui TypeScript client SDK (versions up to and including 0.0.58) allows a party that controls the interrupt/event producer to permanently wedge a conversation thread by emitting one or more Interrupt objects that omit the expiresAt field. isInterruptExpired treats a missing expiresAt as 'never expires', and the client's resume-coverage check requires every pending interrupt to be addressed before the thread can run again, so the thread stays blocked; before the fix there was also no cap on how many pending interrupts were tracked per thread. No public exploit code has been confirmed (a public PoC reference exists; it is not verified as working exploit code), CVE is not in CISA KEV, and impact is availability-only with no data exposure or modification.
Improper input validation in the AG-UI protocol SDK transport decoder path affects ag-ui versions up to and including 0.0.58, allowing crafted event content to be parsed without proper text handling and producing limited confidentiality, integrity and availability impact. The attack is remote and requires low-level privileges (PR:L with no user interaction), meaning the attacker must be an authorized participant able to submit events over an AG-UI transport rather than an anonymous internet user. A public PoC reference exists (GitHub issue 2524) but it is not verified as working exploit code, and the vendor fix is available in 0.0.59 via commit 660182b973a44b8eda5484b14b88eb9cc251edc4.
Denial of service in the ag-ui TypeScript client SDK (versions up to 0.0.58) where the SSE/protobuf stream parser fails to cap buffered data, so a malicious or compromised AG-UI server can force excessive memory consumption in the consuming client. Exploitation requires control over the data delivered into the event stream and a low-privileged stream connection (CVSS PR:L), confining impact to low availability loss with no confidentiality or integrity effect; a public PoC reference exists but is not verified as working exploit code, and no active exploitation has been reported. Priority signals consistently place this as a low-severity, monitor-level issue.
Resource exhaustion in the ag-ui Protocol TypeScript client SDK (versions up to and including 0.0.58) allows a hostile or compromised HTTP endpoint to force the client process to buffer an unbounded error-response body, degrading availability of that client. The flaw sits in the HTTP Transport error path of runHttpRequest, which read non-success response bodies in full with no size limit, so an attacker who controls, has compromised, or can man-in-the-middle the server the client talks to can return an oversized or never-ending body on a non-2xx status and exhaust process memory. Impact is availability-only for the initiating client - no data disclosure or modification - and a public PoC reference exists (GitHub issue 2521); it is not verified as working exploit code. An upstream fix is proposed in pull request 2698 but is not yet merged or released, and the current assessment rates this as a medium-severity, availability-only issue rather than a top-priority emergency.
Cross-origin information disclosure in the ag-ui TypeScript client: HttpAgent builds the POST run request with the conversation payload and the developer's Authorization/Bearer headers, and in versions up to and including 0.0.58 it left fetch's redirect policy at its default, so a redirect served by the configured endpoint (or injected by a man-in-the-middle on that path) causes that request to be re-issued at another origin, leaking its contents. Exploitation therefore requires control of the upstream endpoint or the network path, not merely the ability to reach a well-behaved TLS endpoint; the CVSS 4.0 vector scores it 6.9 with PR:N, VC:L, and E:P. A public PoC reference exists (issue #2520); it is not verified as working exploit code, and there is no CISA KEV listing. The upstream fix is PR #2575, which pins redirect to "error".
Uncaught exception handling in the A2A middleware of ag-ui-protocol ag-ui (all versions up to 2026-09-07) allows an attacker who can control the arguments of a tool call to crash or permanently hang an agent run stream. Supplying malformed JSON, or valid JSON that is not a usable object (null, a bare number, a string, or an array), reaches an unguarded JSON.parse path in the middleware's conversion logic and throws before any error-catching exists, leaving the run neither completed nor errored. The issue is network-reachable but requires low-level/authenticated privilege to inject the crafted tool-call arguments (CVSS 4.0 base 5.3, PR:L; independent assessment CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L), and impact is limited to availability of the affected run with no confidentiality or integrity effect. There is no public exploit identified at time of analysis; the vendor fixed the flaw in release 2026-09-08.
Incomplete cleanup of per-run state in the ag-ui TypeScript client SDK's FilterToolCallsMiddleware allows disallowed tool-call events from one agent run to escape filtering - or valid events from another run to be wrongly blocked - when a single middleware instance or subscription serves more than one run. Affected deployments are those using ag-ui (ag-ui-protocol) client SDK builds up to 2026-09-07 that rely on FilterToolCallsMiddleware with a disallowedToolCalls list as a real security control, in a pattern where runs overlap, stall, or reuse runId/toolCallId values. The issue is rated CVSS 4.0 5.3 (assessed as CVSS 3.1 AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L) - an authenticated, low-privileged party who can start agent runs is the relevant actor; impact is bounded to filter bypass and mis-blocking rather than code execution, and no public exploit identified at time of analysis. Vendor-released patch: 2026-09-08.
Unbounded buffering in the Server-Sent Events parser of the AG-UI Community SDK (Kotlin/Java) lets a malicious or man-in-the-middle-positioned agent endpoint drive a client-side memory exhaustion condition, degrading or killing the consuming process. All ag-ui-protocol ag-ui builds up to 2026-09-23 are flagged by CPE, specifically the Kotlin Community SDK SseParser.kt and its Java counterpart SseEventParser, which had no per-line or per-event size caps before the fix. Impact is availability-only (no confidentiality or integrity effect), an upstream fix exists as PR #2657 but was still awaiting acceptance, and no public exploit was identified at time of analysis.
Unbounded request-body reads in the ag-ui Java community server SDK (JdkAgentHttpHandler, used by applications that instantiate the two-argument handler constructors) allow a remote attacker to exhaust server heap memory by posting an oversized body - or a chunked body without a Content-Length header - to the agent context path, causing a denial of service. The issue affects ag-ui releases up to 2026-09-23 and is rated low-to-moderate (CVSS 4.0 base 5.3; our independent assessment CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L), with impact confined to availability and no confidentiality or integrity effect. No public exploit code or confirmed active exploitation was identified at time of analysis, and the handler's lack of built-in authentication means the practical privilege requirement depends on how each deployment fronts the endpoint; an upstream fix exists as pull request #2671 but is not yet merged/accepted.
Unbounded memory growth in the ag-ui (AG-UI protocol) C++ community SDK's Server-Sent Events parser lets an attacker who can control or influence the consumed SSE stream exhaust the parsing process's memory, producing a denial of service. The flaw lives in sdks/community/c++/src/stream/sse_parser.cpp, where the buffer guard compares only m_buffer plus the incoming chunk against kMaxBufferSize and ignores the per-event accumulator m_currentData, so a single event that is never terminated by a blank line and delivered as many small chunks grows without bound. It is rated CVSS 5.3 (CVSS:4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L) / CVSS:3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L, availability-only and requiring the low-privilege, authorized position of the stream producer; no public exploit identified at time of analysis, and an upstream fix is available (commit ab6e0bc, PR #2501).
Unbounded memory growth in the AG-UI Rust client's SSE frame parser (crates/ag-ui-client/src/sse.rs, shipped in the ag-ui 1.0 community SDK) lets a malicious, compromised, or machine-in-the-middle SSE server exhaust the memory of the consuming client process by streaming a frame it never terminates with a blank-line delimiter. No public exploit code has been identified at time of analysis and the issue is not confirmed as actively exploited (CISA KEV), but the outcome is a denial of service confined to the client process, matching the independently assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L rather than the higher CVSS 4.0 score of 6.9. Exploitation requires the Rust client to open an SSE connection to an endpoint that the attacker controls, has compromised, or can intercept; a correctly behaving server never triggers the flaw, so this is a client-side parsing weakness rather than a remotely reachable listening service.
Memory exhaustion in the AG-UI Go community SDK's SSE client allows a remote attacker who controls or can intercept an SSE endpoint to drive the client process out of memory by sending a stream that never terminates a line, or an oversized single frame. The affected component is sdks/community/go/pkg/client/sse/client.go in ag-ui, and impact is availability-only with no data disclosure or modification, consistent with the assessed CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L. No public exploit was identified at time of analysis; an upstream fix exists as pull request #2700 but a released patched version is not independently confirmed.
Origin validation errors in the AG-UI TypeScript client SDK (ag-ui 1.0) allow remote, low-privileged attackers who can influence an agent event stream to bypass event-origin checks and release the pending-interrupt gate, yielding low confidentiality, integrity, and availability impact. Affected deployments are those consuming untrusted or compromised AG-UI event sources; the advisory describes manipulation of the TEXT_MESSAGE_START argument, while the upstream fix PR #2701 also addresses an interrupt/resume state flaw where a stream emits an interrupt outcome and then finishes a subsequent run without a resume. Independent assessment rates this medium severity (vendor CVSS 4.0 base 5.3) with no signals of elevated real-world risk; no public exploit identified at time of analysis, and no CISA KEV entry.
A permissive cross-origin resource sharing (CORS) misconfiguration in the AG-UI aws-strands Python integration (ag-ui 0.3.0) allows a remote, unauthenticated attacker who convinces a victim to load an attacker-controlled web page to issue cross-origin requests against a deployed agent endpoint and read limited response data. The flaw is confined to deployments that bootstrap a FastAPI app via create_strands_app in integrations/aws-strands/python/src/ag_ui_strands/utils.py, where the helper installs wildcard CORS (any origin, method, and header) and mounts the agent route with no authentication dependency; deployments that supply an explicit origins allowlist, set cors_enabled=False, or attach an auth dependency are not affected. Exploitation is rated high complexity and difficult (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N, CVSS 4.0 base 2.3), the impact is limited to low confidentiality loss with no integrity or availability effect, and the browser prohibition on combining wildcard origins with credentialed requests further constrains what a successful attack can expose. No confirmed active exploitation (no CISA KEV listing) and no public exploit code were identified at time of analysis, and no EPSS score was provided in the source data.