CVE-2026-118274
a2ui-project a2ui Binder generic-binder.ts resource consumption
- State
- Published
- Severity
- 5.3 Medium
- Published
- Oct 28, 2026
- Updated
- Oct 28, 2026
- Reserved
- Oct 27, 2026
Description
A vulnerability has been found in a2ui-project a2ui up to 0.10.6. Affected by this issue is some unknown functionality of the file renderers/web_core/src/v0_9/rendering/generic-binder.ts of the component Binder. The manipulation leads to resource consumption. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of the patch is c97f4a02d3fea33ce3e9de5cf3fd0e3b8f3a4f0e. To fix this issue, it is recommended to deploy a patch.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 5.3 Medium | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P | VulDB |
| 3.1 | 4.3 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C | VulDB |
| 3.0 | 4.3 Medium | CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:O/RC:C | VulDB |
| 2.0 | 4.0 Medium | AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:OF/RC:C | VulDB |
Weaknesses
Affected Products
| Product | Versions |
|---|---|
a2uia2ui-project |
|
References
- VDB-427572 | a2ui-project a2ui Binder generic-binder.ts resource consumptionvdb-entry
- VDB-427572 | CTI Indicators (IOB, IOC, TTP, IOA)signaturepermissions-required
- CVE-2026-118274 | CVE Analysis and Reportthird-party-advisory
- Submit #1015118 | a2ui-project a2ui <=0.10.6 CWE-400third-party-advisory
- https://github.com/a2ui-project/a2ui/issues/2387exploitissue-tracking
- https://github.com/a2ui-project/a2ui/pull/2431issue-trackingpatch
- https://github.com/a2ui-project/a2ui/commit/c97f4a02d3fea33ce3e9de5cf3fd0e3b8f3a4f0epatch
- https://github.com/a2ui-project/a2ui/product
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.