CVE-2026-120235

AG-UI framing decoders accumulate unbounded incomplete messages

AG-UI Protocol · @ag-ui/client SSE and protobuf decoders

First documented disclosure · Review checkpoint

Summary

A stream without a completed frame can grow client buffers until memory is exhausted.

Severity and exploitation evidence

Medium · 5.3/10 · CVSS 4.0. Severity source.

Exploitation not established: Controlled researcher evidence; the reviewed primary sources do not establish malicious exploitation or a confirmed victim.

Exploitation evidence source

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

The SSE decoder accumulates an unterminated event tail; the protobuf decoder repeatedly buffers data while waiting for the declared message length. Neither original path imposes a framing limit.

Conditions required

A malicious or compromised agent endpoint supplies a boundary-less SSE stream or an unsatisfied protobuf length prefix to an affected client.

Potential impact

Client memory exhaustion and loss of availability; the researcher measured hundreds of megabytes of heap growth from 30 MB of SSE data. No code execution or victim incident is established.

Affected versions and configurations

CNA lists through 0.0.58; direct inspection finds both unbounded paths also in the published 0.0.59 package.

Fix and mitigation status

Fix commit 9e7b2b0 merged September 9. Framing limits are verified in the published 1.0.0 package of September 17 and in 1.0.3; this is an issue-specific observation.

Practical next steps

Use a supported client release containing the framing guards and test legitimate large events. Impose overall transport budgets and cancellation in addition to parser limits.

Operating lesson

A streaming interface can still buffer without limit while it waits for a message boundary.

Evidence and limits

Public issue August 25; fix PR September 4 and merge September 9; CNA November 1. The CNA-linked October 30 release publishes other adapter packages and does not establish a client version. Integrity-verified 1.0.0 source has an SSE tail limit counted in characters and a protobuf declared-frame limit, not a guarantee of a 10 MB total heap ceiling.

Sources