CVE-2026-101098
ag-ui-protocol ag-ui HTTP JdkAgentHttpHandler.java readAllBytes resource consumption
- State
- Published
- Severity
- 5.3 Medium
- Published
- Sep 28, 2026
- Updated
- Sep 28, 2026
- Reserved
- Sep 28, 2026
Description
A security vulnerability has been detected in ag-ui-protocol ag-ui up to 2026-09-23. Affected by this issue is the function readAllBytes of the file JdkAgentHttpHandler.java of the component HTTP Handler. Such manipulation leads to resource consumption. The attack can be launched remotely. The pull request to fix this issue awaits acceptance.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X | VulDB |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C | VulDB |
| 3.0 | 4.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C | VulDB |
| 2.0 | 4.0 Medium | AV:N/AC:L/Au:S/C:N/I:N/A:P/E:ND/RL:ND/RC:C | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
ag-uiag-ui-protocol |
|
References
- VDB-410973 | ag-ui-protocol ag-ui HTTP JdkAgentHttpHandler.java readAllBytes resource consumptionvdb-entrytechnical-description
- VDB-410973 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-101098 | CVE Analysis and Reportthird-party-advisory
- Submit #934960 | ag-ui-protocol ag-ui v1.0 CWE-400third-party-advisory
- https://github.com/ag-ui-protocol/ag-ui/issues/2441issue-tracking
- https://github.com/ag-ui-protocol/ag-ui/pull/2671issue-trackingpatch
- https://github.com/ag-ui-protocol/ag-ui/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.