CVE-2026-92363 Details
Description
A flaw has been found in ag-ui-protocol ag-ui 1.0. Affected is an unknown function of the file src/stream/sse_parser.cpp of the component JSON Parser. Executing a manipulation can lead to resource consumption. The attack may be performed from remote. This patch is called ab6e0bc298996caac2b4b0b3ec0bd8d32a15a186. Applying a patch is advised to resolve this issue.
A denial-of-service vulnerability has been identified in the AG-UI protocol implementation, specifically in version 1.0. The issue arises within the JSON parser component, located in the file 'src/stream/sse_parser.cpp'. The vulnerability allows for uncontrolled resource consumption by bypassing the protocol's buffer size limit, leading to potential memory exhaustion. This issue can be exploited remotely by sending oversized events that are fragmented into small chunks, causing the per-event data accumulator to grow without bound. Additionally, the JSON parser lacks a depth limit, allowing deeply nested structures to cause stack overflows and process crashes.
Users are advised to update to the latest version of AG-UI, where this vulnerability has been addressed. The official AG-UI GitHub repository contains the patched version.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 16, 2026CISA-ADP
Assessed Sep 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ag-ui-protocol/ag-ui/ | [email protected] | Vendor |
| https://github.com/ag-ui-protocol/ag-ui/commit/ab6e0bc298996caac2b4b0b3ec0bd8d32a15a186 | [email protected] | Source CodeVendor |
| https://github.com/ag-ui-protocol/ag-ui/issues/2440 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/ag-ui-protocol/ag-ui/pull/2501 | [email protected] | Source CodeVendor |
| https://vuldb.com/cve/CVE-2026-92363 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/934957 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/405449 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/405449/cti | [email protected] | Content Wall |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-404 | Improper Resource Shutdown or Release | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ag-ui-protocol ag-ui | 1.0 |
CPE
Remediation
| |
| ag-ui-protocol ag-ui community C++ SDK | All versions |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 18, 2026 | CVE Modified | CISA-ADP |
| Sep 16, 2026 | New CVE Received | [email protected] |