CVE-2026-92363: ag-ui-protocol ag-ui JSON sse_parser.cpp resource consumption
A flaw has been found in ag-ui-protocol ag-ui 1.0. Affected is an unknown function of the file src/stream/sseparser.cpp of the component JSON Parser. Executing a manipulation can lead to resource consumption. The attack may be performed from remote. This patch is called ab6e0bc298996caac2b4b0b3ec0bd8d32a15a186. Applying a patch is advised to resolve this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ag-ui-protocol ag-uito a version that resolves this vulnerability.Fixed in 1.0Patch ab6e0bc298996caac2b4b0b3ec0bd8d32a15a186 - Compensating control
Mitigate potential remote resource consumption by applying network-level controls (e.g., restrict inbound access to the affected ag-ui-protocol ag-ui service) until the patch ab6e0bc298996caac2b4b0b3ec0bd8d32a15a186 is applied.
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using ag-ui-protocol/ag-ui 1.0 with the affected JSON parsing code may be exposed, particularly where an attacker can reach the service remotely. The vulnerability has an availability impact only, rated low in the supplied vector.
What access does an attacker need?
An attacker needs network access and low privileges. No user interaction is required.
What should be done if the deployment is affected?
Apply patch ab6e0bc298996caac2b4b0b3ec0bd8d32a15a186. The provided information does not identify an alternative mitigation or affected configuration condition.