A weakness has been identified in ag-ui-protocol ag-ui up to 0.0.58. This impacts the function e.text of the component HTTP Transport. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.
Fix
Patch, vendor advisory and mitigation references on NVD 1
- https://github.com/ag-ui-protocol/ag-ui/pull/2698 issue-tracking, patch
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 5.3 · ag-ui-protocolNVD modified 2026-11-01 15:30
Affected (CPE criteria) 1
cpe:2.3:a:ag-ui-protocol:ag-ui:*:*:*:*:*:*:*:*
References 7
- https://vuldb.com/vuln/429593 vdb-entry, technical-description
- https://vuldb.com/vuln/429593/cti signature, permissions-required
- https://vuldb.com/cve/CVE-2026-120234 third-party-advisory
- https://vuldb.com/submit/1015146 third-party-advisory
- https://github.com/ag-ui-protocol/ag-ui/issues/2521 exploit, issue-tracking
- https://github.com/ag-ui-protocol/ag-ui/pull/2698 issue-tracking, patch
- https://github.com/ag-ui-protocol/ag-ui/ product