CVE-2026-120234 Details

A denial-of-service vulnerability has been identified in the AG-UI Protocol's HTTP Transport component, affecting versions through 0.0.58. This vulnerability arises because error responses are read into memory in their entirety, without any size limits or streaming, leading to unbounded resource consumption. The issue can be exploited remotely, and the public availability of the exploit raises concerns about potential attacks. A pull request to address this vulnerability is pending acceptance.

The vulnerability can be remediated by modifying the HTTP error handling to read responses through a streaming reader, under a byte budget, and to truncate the error message before it is embedded in the Error object. This approach would prevent large error bodies from being fully buffered into memory.