CVE-2026-92362 in ag-ui
Summary
by MITRE • 09/16/2026
A vulnerability was detected in ag-ui-protocol ag-ui 1.0. This impacts an unknown function of the file crates/ag-ui-client/src/sse.rs of the component SSE Frame Parser. Performing a manipulation results in resource consumption. The attack is possible to be carried out remotely. The pull request to fix this issue awaits acceptance.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/16/2026
The ag-ui-protocol library, specifically version 1.0, contains a critical flaw within its Server-Sent Events frame parser implementation located in the crates/ag-ui-client/src/sse.rs module. This vulnerability represents a significant risk for applications relying on real-time data streaming via SSE, as it allows an attacker to trigger excessive resource consumption through remote manipulation of input streams. The core issue lies in how the parser handles specific malformed or specially crafted event frames that deviate from expected structural norms. Instead of rejecting invalid inputs efficiently or limiting processing overhead, the flawed logic causes the application to engage in prolonged computational cycles or memory allocation patterns designed for valid data structures but misapplied here. This behavior effectively creates a pathway for resource exhaustion attacks without requiring authentication, making it particularly dangerous in public-facing services that process SSE feeds from untrusted sources.
From a technical perspective, this vulnerability aligns with CWE-400, which classifies issues related to unconstrained resource consumption. The attacker can exploit the parser's inability to properly validate frame boundaries or content length before processing, leading to denial of service conditions where system resources such as CPU cycles and memory are depleted rapidly. This type of flaw is often categorized under ATT&CK technique T1496, Resource Hijacking, specifically when used for Denial of Service purposes by exhausting computational resources. The remote nature of the attack vector means that any entity capable sending HTTP requests to a service utilizing this library can potentially trigger the vulnerability, regardless of their location or identity. This lack of access control exacerbates the severity, as it removes traditional network-based barriers that might otherwise limit exposure.
The operational impact of this flaw is primarily centered on availability and stability. Services dependent on ag-ui-client for handling SSE connections may experience degraded performance, increased latency, or complete unresponsiveness when subjected to maliciously crafted payloads. In high-throughput environments where many concurrent SSE streams are maintained, the cumulative effect of multiple such attacks could lead to cascading failures across infrastructure components that rely on these services. Furthermore, because the fix is currently awaiting acceptance in a pull request, organizations using this version remain exposed until an official patch is released and deployed. This interim period requires heightened monitoring for anomalous resource usage patterns associated with SSE endpoints.
Mitigation strategies should focus on both immediate defensive measures and long-term remediation steps. Administrators should implement rate limiting and input validation at the network or application gateway level to filter out suspiciously large or malformed SSE frames before they reach the vulnerable parser. Deploying Web Application Firewalls configured to detect patterns of resource exhaustion can also provide a layer of protection against automated exploitation attempts. Additionally, organizations must prioritize upgrading to a patched version as soon as it becomes available through official channels. Until then, continuous monitoring for spikes in CPU and memory usage correlated with SSE traffic is essential to identify potential active exploits early. Regular security audits of dependencies are crucial to ensure that such vulnerabilities do not persist unnoticed within the software supply chain.