CVE-2026-118271: a2ui-project a2ui data-context Resolver data-context.ts resource consumption
A security vulnerability has been detected in a2ui-project a2ui up to 0.10.6. This impacts an unknown function of the file renderers/webcore/src/v09/rendering/data-context.ts of the component data-context Resolver. Such manipulation leads to resource consumption. The attack may be performed from remote. The exploit has been disclosed publicly and may be used. The name of the patch is eb314e14fabd29cfb4a74e1202afc4fe2081efa2. Applying a patch is advised to resolve this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
a2ui-project/a2uito a version that resolves this vulnerability.Patch eb314e14fabd29cfb4a74e1202afc4fe2081efa2
Event History
Frequently Asked Questions
Which deployments are affected?
a2ui-project a2ui versions up to and including 0.10.6 are identified as affected. The issue is in the data-context Resolver associated with renderers/web_core/src/v0_9/rendering/data-context.ts.
What access does an attacker need?
The attack can be performed remotely and has low attack complexity, but it requires low-level privileges. No user interaction is required.
What is the practical impact?
Successful manipulation can cause resource consumption, resulting in an availability impact. No confidentiality or integrity impact is identified in the supplied severity vector.
Is public exploitation information available?
Yes. The exploit has been publicly disclosed and may be used.
What remediation is available?
Apply the patch identified as eb314e14fabd29cfb4a74e1202afc4fe2081efa2. The provided data advises patching to resolve the issue.