CVE-2026-92362
HighCVSS 7.3Summary
A vulnerability was detected in ag-ui-protocol ag-ui 1.0. This impacts an unknown function of the file crates/ag-ui-client/src/sse.rs of the component SSE Frame Parser. Performing a manipulation results in resource consumption. The attack is possible to be carried out remotely. The pull request to fix this issue awaits acceptance.
Risk Assessment
A remote attacker can cause resource exhaustion, potentially leading to denial of service (DoS) and application unavailability. This affects the stability of systems using this component.
Recommendation
Monitor for the fix and update ag-ui to a version containing the resolution as soon as possible. Until a fix is released, limit external exposure of the service and implement resource consumption limits.
Other vulnerabilities in ag-ui-protocol ag-ui
See all- CVE-2026-120237Medium
A flaw has been found in ag-ui-protocol ag-ui up to 0.0.58 in the isInterruptExpired function of sdks/typescript/packages/client/src/interrupts/index.ts, within the Interrupt expiry component. The manipulation causes resource consumption. Remote exploitation is possible and the exploit has been published.
- CVE-2026-92359Low
A security flaw has been discovered in ag-ui-protocol ag-ui 0.3.0. The affected element is the function create_strands_app of the file integrations/aws-strands/python/src/ag_ui_strands/utils.py of the component CORSMiddleware. The manipulation results in permissive cross-domain policy with untrusted domains. The attack may be launched remotely. The attack requires a high level of complexity. The exploitability is described as difficult.
Original NVD description (English source)
A vulnerability was detected in ag-ui-protocol ag-ui 1.0. This impacts an unknown function of the file crates/ag-ui-client/src/sse.rs of the component SSE Frame Parser. Performing a manipulation results in resource consumption. The attack is possible to be carried out remotely. The pull request to fix this issue awaits acceptance.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS