CVE-2026-120234 (GCVE-0-2026-120234)
Vulnerability from cvelistv5
Published
2026-11-01 15:30
Modified
2026-11-01 15:30
Severity ?
2.1 (Low) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RC:C
4.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RC:C
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RC:C
4.3 (Medium) - CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RC:C
VLAI Severity ?
EPSS score ?
Summary
A weakness has been identified in ag-ui-protocol ag-ui up to 0.0.58. This impacts the function e.text of the component HTTP Transport. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.
References
| URL | Tags | ||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||||||||||||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| ag-ui-protocol | ag-ui |
Version: 0.0.1 Version: 0.0.2 Version: 0.0.3 Version: 0.0.4 Version: 0.0.5 Version: 0.0.6 Version: 0.0.7 Version: 0.0.8 Version: 0.0.9 Version: 0.0.10 Version: 0.0.11 Version: 0.0.12 Version: 0.0.13 Version: 0.0.14 Version: 0.0.15 Version: 0.0.16 Version: 0.0.17 Version: 0.0.18 Version: 0.0.19 Version: 0.0.20 Version: 0.0.21 Version: 0.0.22 Version: 0.0.23 Version: 0.0.24 Version: 0.0.25 Version: 0.0.26 Version: 0.0.27 Version: 0.0.28 Version: 0.0.29 Version: 0.0.30 Version: 0.0.31 Version: 0.0.32 Version: 0.0.33 Version: 0.0.34 Version: 0.0.35 Version: 0.0.36 Version: 0.0.37 Version: 0.0.38 Version: 0.0.39 Version: 0.0.40 Version: 0.0.41 Version: 0.0.42 Version: 0.0.43 Version: 0.0.44 Version: 0.0.45 Version: 0.0.46 Version: 0.0.47 Version: 0.0.48 Version: 0.0.49 Version: 0.0.50 Version: 0.0.51 Version: 0.0.52 Version: 0.0.53 Version: 0.0.54 Version: 0.0.55 Version: 0.0.56 Version: 0.0.57 Version: 0.0.58 cpe:2.3:a:ag-ui-protocol:ag-ui:*:*:*:*:*:*:*:* |
{
"containers": {
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:ag-ui-protocol:ag-ui:*:*:*:*:*:*:*:*"
],
"modules": [
"HTTP Transport"
],
"product": "ag-ui",
"vendor": "ag-ui-protocol",
"versions": [
{
"status": "affected",
"version": "0.0.1"
},
{
"status": "affected",
"version": "0.0.2"
},
{
"status": "affected",
"version": "0.0.3"
},
{
"status": "affected",
"version": "0.0.4"
},
{
"status": "affected",
"version": "0.0.5"
},
{
"status": "affected",
"version": "0.0.6"
},
{
"status": "affected",
"version": "0.0.7"
},
{
"status": "affected",
"version": "0.0.8"
},
{
"status": "affected",
"version": "0.0.9"
},
{
"status": "affected",
"version": "0.0.10"
},
{
"status": "affected",
"version": "0.0.11"
},
{
"status": "affected",
"version": "0.0.12"
},
{
"status": "affected",
"version": "0.0.13"
},
{
"status": "affected",
"version": "0.0.14"
},
{
"status": "affected",
"version": "0.0.15"
},
{
"status": "affected",
"version": "0.0.16"
},
{
"status": "affected",
"version": "0.0.17"
},
{
"status": "affected",
"version": "0.0.18"
},
{
"status": "affected",
"version": "0.0.19"
},
{
"status": "affected",
"version": "0.0.20"
},
{
"status": "affected",
"version": "0.0.21"
},
{
"status": "affected",
"version": "0.0.22"
},
{
"status": "affected",
"version": "0.0.23"
},
{
"status": "affected",
"version": "0.0.24"
},
{
"status": "affected",
"version": "0.0.25"
},
{
"status": "affected",
"version": "0.0.26"
},
{
"status": "affected",
"version": "0.0.27"
},
{
"status": "affected",
"version": "0.0.28"
},
{
"status": "affected",
"version": "0.0.29"
},
{
"status": "affected",
"version": "0.0.30"
},
{
"status": "affected",
"version": "0.0.31"
},
{
"status": "affected",
"version": "0.0.32"
},
{
"status": "affected",
"version": "0.0.33"
},
{
"status": "affected",
"version": "0.0.34"
},
{
"status": "affected",
"version": "0.0.35"
},
{
"status": "affected",
"version": "0.0.36"
},
{
"status": "affected",
"version": "0.0.37"
},
{
"status": "affected",
"version": "0.0.38"
},
{
"status": "affected",
"version": "0.0.39"
},
{
"status": "affected",
"version": "0.0.40"
},
{
"status": "affected",
"version": "0.0.41"
},
{
"status": "affected",
"version": "0.0.42"
},
{
"status": "affected",
"version": "0.0.43"
},
{
"status": "affected",
"version": "0.0.44"
},
{
"status": "affected",
"version": "0.0.45"
},
{
"status": "affected",
"version": "0.0.46"
},
{
"status": "affected",
"version": "0.0.47"
},
{
"status": "affected",
"version": "0.0.48"
},
{
"status": "affected",
"version": "0.0.49"
},
{
"status": "affected",
"version": "0.0.50"
},
{
"status": "affected",
"version": "0.0.51"
},
{
"status": "affected",
"version": "0.0.52"
},
{
"status": "affected",
"version": "0.0.53"
},
{
"status": "affected",
"version": "0.0.54"
},
{
"status": "affected",
"version": "0.0.55"
},
{
"status": "affected",
"version": "0.0.56"
},
{
"status": "affected",
"version": "0.0.57"
},
{
"status": "affected",
"version": "0.0.58"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "reporter",
"value": "ez-lbz (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A weakness has been identified in ag-ui-protocol ag-ui up to 0.0.58. This impacts the function e.text of the component HTTP Transport. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 4,
"vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-404",
"description": "Denial of Service",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-11-01T15:30:16.548Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-429593 | ag-ui-protocol ag-ui HTTP Transport e.text resource consumption",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/429593"
},
{
"name": "VDB-429593 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/429593/cti"
},
{
"name": "CVE-2026-120234 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-120234"
},
{
"name": "Submit #1015146 | ag-ui-protocol ag-ui \u003c=0.0.58 CWE-400",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/1015146"
},
{
"tags": [
"exploit",
"issue-tracking"
],
"url": "https://github.com/ag-ui-protocol/ag-ui/issues/2521"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/ag-ui-protocol/ag-ui/pull/2698"
},
{
"tags": [
"product"
],
"url": "https://github.com/ag-ui-protocol/ag-ui/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-10-31T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-10-31T01:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-31T21:16:04.000Z",
"value": "VulDB entry last update"
}
],
"title": "ag-ui-protocol ag-ui HTTP Transport e.text resource consumption",
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-120234",
"datePublished": "2026-11-01T15:30:16.548Z",
"dateReserved": "2026-10-31T20:10:39.648Z",
"dateUpdated": "2026-11-01T15:30:16.548Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…