5.3
MediumCVSS 3.1 · from VulDB
CVE-2026-118275
a2ui-project a2ui Resolver data-context.ts DataContext.resolveSignal resource consumption
a2ui · Uncontrolled resource use · CWE-400Affecteda2ui
FixA patch is linked in the references.
PublishedOct 28, 03:30 · VulDB
ScoredOct 28 · 5.3 · VulDB
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:09 UTC
What we know
No known exploitation. CISA KEV, checked 22:09 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker only needs network access to the target. No login needed. CVSS: network, no privileges.
Description
A vulnerability was found in a2ui-project a2ui up to 0.10.6. This affects the function DataContext.resolveSignal of the file renderers/web_core/src/v0_9/rendering/data-context.ts of the component Resolver. The manipulation results in resource consumption. The attack can be launched remotely. The exploit has been made public and could be used. The patch is identified as c76e17272e52c12c6dcf68905b1df978c39e9aa5. It is advisable to implement a patch to correct this issue.
From VulDB
Affected and fixed versions
ProductAffectedFixed ina2ui0.10.0–a2ui0.10.1–a2ui0.10.2–a2ui0.10.3–a2ui0.10.4–a2ui0.10.5–a2ui0.10.6–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known