CVE-2026-118273 Details
Description
A flaw has been found in a2ui-project a2ui up to 0.10.6. Affected by this vulnerability is the function DataModel.set of the file renderers/web_core/src/v0_9/state/data-model.ts. Executing a manipulation can lead to resource consumption. It is possible to launch the attack remotely. The exploit has been published and may be used. This patch is called 82789191ce551f4d7a095d273773fb24bd764c9d. A patch should be applied to remediate this issue.
A denial-of-service vulnerability has been identified in the A2UI Project A2UI, specifically in versions through 0.10.6. The issue arises in the DataModel.set function within the file renderers/web_core/src/v0_9/state/data-model.ts. When large array indices are used, the target array expands without any upper limit, leading to significant resource consumption. This flaw can be exploited remotely, causing the application to hang or crash due to out-of-memory errors.
A patch has been released in version 0.10.7, which enforces maximum array index bounds and optimizes how array signals are cloned. Users should update to this version to address the vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 28, 2026CISA-ADP
Assessed Nov 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/a2ui-project/a2ui/ | [email protected] | Vendor |
| https://github.com/a2ui-project/a2ui/commit/82789191ce551f4d7a095d273773fb24bd764c9d | [email protected] | Source CodeVendor |
| https://github.com/a2ui-project/a2ui/issues/2386 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/a2ui-project/a2ui/pull/2430 | [email protected] | Issue TrackingVendor |
| https://vuldb.com/cve/CVE-2026-118273 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1015117 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/427571 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/427571/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-404 | Improper Resource Shutdown or Release | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| a2ui-project a2ui | <= 0.10.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 2, 2026 | CVE Modified | CISA-ADP |
| Oct 28, 2026 | New CVE Received | [email protected] |