CVE-2026-118275 Details
Description
A vulnerability was found in a2ui-project a2ui up to 0.10.6. This affects the function DataContext.resolveSignal of the file renderers/web_core/src/v0_9/rendering/data-context.ts of the component Resolver. The manipulation results in resource consumption. The attack can be launched remotely. The exploit has been made public and could be used. The patch is identified as c76e17272e52c12c6dcf68905b1df978c39e9aa5. It is advisable to implement a patch to correct this issue.
A denial-of-service vulnerability has been identified in the A2UI project, specifically in versions through 0.10.6. The issue arises in the DataContext.resolveSignal function within the web_core renderer, version 0.9. This vulnerability allows for excessive resource consumption by recursively processing nested function call arguments without a depth limit, leading to a stack overflow. The problem occurs during the initial resolution of dynamic values in the user interface, causing the application to crash.
Users can update to A2UI version 0.10.7, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 28, 2026CISA-ADP
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/a2ui-project/a2ui/ | [email protected] | Vendor |
| https://github.com/a2ui-project/a2ui/commit/c76e17272e52c12c6dcf68905b1df978c39e9aa5 | [email protected] | Source CodeVendor |
| https://github.com/a2ui-project/a2ui/issues/2388 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/a2ui-project/a2ui/pull/2432 | [email protected] | Issue TrackingVendor |
| https://vuldb.com/cve/CVE-2026-118275 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/1015137 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/427573 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/427573/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-404 | Improper Resource Shutdown or Release | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| a2ui-project a2ui | <= 0.10.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | CVE Modified | CISA-ADP |
| Oct 28, 2026 | New CVE Received | [email protected] |