CVE-2026-120235
4.3 MEDIUMpublic exploit availablePublished 2026-11-01 · Updated 2026-11-01
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
A security vulnerability has been detected in ag-ui-protocol ag-ui up to 0.0.58. Affected is the function parseSSEStream of the file sdks/typescript/packages/client/src/transform/sse.ts of the component SSE Parser. The manipulation leads to resource consumption. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is 9e7b2b00bce215bbf731f1e6094f63812527c432. The affected component should be upgraded.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-400, CWE-404
Public exploit & PoC references
All references
- https://github.com/ag-ui-protocol/ag-ui/
- https://github.com/ag-ui-protocol/ag-ui/commit/9e7b2b00bce215bbf731f1e6094f63812527c432
- https://github.com/ag-ui-protocol/ag-ui/issues/2522
- https://github.com/ag-ui-protocol/ag-ui/pull/2627
- https://github.com/ag-ui-protocol/ag-ui/releases/tag/release/2026-10-30
- https://vuldb.com/cve/CVE-2026-120235
- https://vuldb.com/submit/1015147
- https://vuldb.com/vuln/429594
- https://vuldb.com/vuln/429594/cti
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2026-101098PoC
- MEDIUMCVE-2026-108577
- MEDIUMCVE-2026-109144PoC
- LOWCVE-2026-112157PoC
- MEDIUMCVE-2026-117503PoC
- MEDIUMCVE-2026-117505PoC
- MEDIUMCVE-2026-117506PoC
- MEDIUMCVE-2026-118271PoC
Related by shared AI tags and CWE weakness class. Browse the full archive.