Vulnerability · Published Nov 1, 2026 · Assigned by VulDB
CVE-2026-120234ag-ui-protocol ag-ui HTTP Transport e.text resource consumption
Medium 4.3
In plain English
A medium-severity uncontrolled resource consumption in ag-ui from ag-ui-protocol. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).
Official description
A weakness has been identified in ag-ui-protocol ag-ui up to 0.0.58. This impacts the function e.text of the component HTTP Transport. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| ag-ui-protocol | ag-ui | 0.0.10.0.20.0.30.0.40.0.50.0.60.0.70.0.8 |
Weakness: CWE-400, CWE-404 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C
References
- VDB-429593 | ag-ui-protocol ag-ui HTTP Transport e.text resource consumption vdb-entry, technical-description
- VDB-429593 | CTI Indicators (IOB, IOC, TTP, IOA) signature, permissions-required
- CVE-2026-120234 | CVE Analysis and Report third-party-advisory
- Submit #1015146 | ag-ui-protocol ag-ui <=0.0.58 CWE-400 third-party-advisory
- https://github.com/ag-ui-protocol/ag-ui/issues/2521 exploit, issue-tracking
- https://github.com/ag-ui-protocol/ag-ui/pull/2698 issue-tracking, patch
- https://github.com/ag-ui-protocol/ag-ui/ product