CVE-2026-118274 Details
Description
A vulnerability has been found in a2ui-project a2ui up to 0.10.6. Affected by this issue is some unknown functionality of the file renderers/web_core/src/v0_9/rendering/generic-binder.ts of the component Binder. The manipulation leads to resource consumption. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is c97f4a02d3fea33ce3e9de5cf3fd0e3b8f3a4f0e. To fix this issue, it is recommended to deploy a patch.
A denial-of-service vulnerability has been identified in the A2UI Project's A2UI component, specifically in versions through 0.10.6. The issue arises within the 'Generic Binder' functionality, where 'ChildList' templates can lead to unbounded resource consumption. This occurs when a data-model array is referenced, causing the application to materialize an excessive number of child components without any length limit. The vulnerability can be exploited remotely, and the resulting resource drain can freeze the user interface or cause out-of-memory errors.
The vulnerability has been addressed in version 0.10.7, where the 'Generic Binder' now caps the dynamic child list materialization to a maximum of 1,000 items. Users are advised to update to this version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 28, 2026CISA-ADP
Assessed Nov 3, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/a2ui-project/a2ui/ | [email protected] | Vendor |
| https://github.com/a2ui-project/a2ui/commit/c97f4a02d3fea33ce3e9de5cf3fd0e3b8f3a4f0e | [email protected] | Source CodeVendor |
| https://github.com/a2ui-project/a2ui/issues/2387 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/a2ui-project/a2ui/pull/2431 | [email protected] | Issue TrackingVendor |
| https://vuldb.com/cve/CVE-2026-118274 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1015118 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/427572 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/427572/cti | [email protected] | AdvisoryContent Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-404 | Improper Resource Shutdown or Release | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| a2ui-project a2ui | <= 0.10.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Nov 3, 2026 | CVE Modified | CISA-ADP |
| Oct 28, 2026 | New CVE Received | [email protected] |