4.3
MediumCVSS 3.1 · from VulDB
CVE-2026-120234
ag-ui-protocol ag-ui HTTP Transport e.text resource consumption
ag-ui · Uncontrolled resource use · CWE-400Affectedag-ui
FixA patch is linked in the references.
PublishedNov 1, 15:30 · VulDB
ScoredNov 1 · 4.3 · VulDB
Exploit code publicNone known · checked 23:18 UTC
ExploitedNone known · CISA KEV checked 23:19 UTC
What we know
No known exploitation. CISA KEV, checked 23:19 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 23:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
Description
A weakness has been identified in ag-ui-protocol ag-ui up to 0.0.58. This impacts the function e.text of the component HTTP Transport. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.
From VulDB
Affected and fixed versions
ProductAffectedFixed inag-ui0.0.1–ag-ui0.0.2–ag-ui0.0.3–ag-ui0.0.4–ag-ui0.0.5–ag-ui0.0.6–ag-ui0.0.7–ag-ui0.0.8–ag-ui0.0.9–ag-ui0.0.10–ag-ui0.0.11–ag-ui0.0.12–ag-ui0.0.13–ag-ui0.0.14–ag-ui0.0.15–ag-ui0.0.16–ag-ui0.0.17–ag-ui0.0.18–ag-ui0.0.19–ag-ui0.0.20–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known