CVE-2026-120234
ag-ui-protocol ag-ui HTTP Transport e.text resource consumption
CVSS Score
4.3
EPSS Score
0.0%
EPSS Percentile
0th
A weakness has been identified in ag-ui-protocol ag-ui up to 0.0.58. This impacts the function e.text of the component HTTP Transport. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.
| CWE | CWE-400 CWE-404 |
| Vendor | ag-ui-protocol |
| Product | ag-ui |
| Published | Nov 1, 2026 |
Stay Ahead of the Next One
Get instant alerts for ag-ui-protocol ag-ui
Be the first to know when new medium vulnerabilities affecting ag-ui-protocol ag-ui are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Affected Versions
ag-ui-protocol / ag-ui
0.0.1 0.0.2 0.0.3 0.0.4 0.0.5 0.0.6 0.0.7 0.0.8 0.0.9 0.0.10 0.0.11 0.0.12 0.0.13 0.0.14 0.0.15 0.0.16 0.0.17 0.0.18 0.0.19 0.0.20 0.0.21 0.0.22 0.0.23 0.0.24 0.0.25 0.0.26 0.0.27 0.0.28 0.0.29 0.0.30 0.0.31 0.0.32 0.0.33 0.0.34 0.0.35 0.0.36 0.0.37 0.0.38 0.0.39 0.0.40 0.0.41 0.0.42 0.0.43 0.0.44 0.0.45 0.0.46 0.0.47 0.0.48 0.0.49 0.0.50 0.0.51 0.0.52 0.0.53 0.0.54 0.0.55 0.0.56 0.0.57 0.0.58
References
vuldb.com: https://vuldb.com/vuln/429593 vuldb.com: https://vuldb.com/vuln/429593/cti vuldb.com: https://vuldb.com/cve/CVE-2026-120234 vuldb.com: https://vuldb.com/submit/1015146 github.com: https://github.com/ag-ui-protocol/ag-ui/issues/2521 github.com: https://github.com/ag-ui-protocol/ag-ui/pull/2698 github.com: https://github.com/ag-ui-protocol/ag-ui/
Credits
🔍 ez-lbz (VulDB User) VulDB CNA Team