CVE-2026-118274: a2ui-project a2ui Binder generic-binder.ts resource consumption
A vulnerability has been found in a2ui-project a2ui up to 0.10.6. Affected by this issue is some unknown functionality of the file renderers/webcore/src/v09/rendering/generic-binder.ts of the component Binder. The manipulation leads to resource consumption. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is c97f4a02d3fea33ce3e9de5cf3fd0e3b8f3a4f0e. To fix this issue, it is recommended to deploy a patch.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
a2ui-project/a2uito a version that resolves this vulnerability.Patch c97f4a02d3fea33ce3e9de5cf3fd0e3b8f3a4f0e
Event History
Frequently Asked Questions
Which deployments are affected?
a2ui-project a2ui versions up to and including 0.10.6 are affected. The issue involves unknown functionality in the Binder component's renderers/web_core/src/v0_9/rendering/generic-binder.ts file.
What does an attacker need to exploit this issue?
The attack can be initiated remotely and has low attack complexity, but it requires low-level privileges. No user interaction is required.
Is public exploit information available?
Yes. An exploit has been publicly disclosed and may be used.
What should teams do if they are affected?
Deploy the patch identified as c97f4a02d3fea33ce3e9de5cf3fd0e3b8f3a4f0e. No alternative mitigation is provided in the available data.