CVE-2026-118275: a2ui-project a2ui Resolver data-context.ts DataContext.resolveSignal resource consumption
A vulnerability was found in a2ui-project a2ui up to 0.10.6. This affects the function DataContext.resolveSignal of the file renderers/webcore/src/v09/rendering/data-context.ts of the component Resolver. The manipulation results in resource consumption. The attack can be launched remotely. The exploit has been made public and could be used. The patch is identified as c76e17272e52c12c6dcf68905b1df978c39e9aa5. It is advisable to implement a patch to correct this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
a2ui-project/a2uito a version that resolves this vulnerability.Patch c76e17272e52c12c6dcf68905b1df978c39e9aa5
Event History
Frequently Asked Questions
Which deployments are affected?
a2ui-project a2ui versions up to 0.10.6 are affected, specifically the Resolver component's DataContext.resolveSignal function in renderers/web_core/src/v0_9/rendering/data-context.ts.
Can this be exploited without credentials or user interaction?
Yes. The supplied severity vector identifies network attack access, low attack complexity, no privileges required, and no user interaction required.
What is the expected impact?
Successful manipulation causes resource consumption, with availability impact rated low. No confidentiality or integrity impact is identified in the supplied vector.
Is public exploit information available?
Yes. The exploit has been made public and could be used.
What remediation is identified?
Apply the patch identified as c76e17272e52c12c6dcf68905b1df978c39e9aa5.