CVE-2026-120235

MediumCVSS 4.3/10Last modified Nov 2, 2026

Description

A security vulnerability has been detected in ag-ui-protocol ag-ui up to 0.0.58. Affected is the function parseSSEStream of the file sdks/typescript/packages/client/src/transform/sse.ts of the component SSE Parser. The manipulation leads to resource consumption. The attack may be initiated remotely. The exploit has been disclosed publicly and may be used. The identifier of the patch is 9e7b2b00bce215bbf731f1e6094f63812527c432. The affected component should be upgraded.

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-400 CWE-404

Affected software

Vendor	Product	Versions
ag-ui-protocol	ag-ui	0.0.1; 0.0.2; 0.0.3; 0.0.4; 0.0.5; 0.0.6; 0.0.7; 0.0.8; 0.0.9; 0.0.10; 0.0.11; 0.0.12; 0.0.13; 0.0.14; 0.0.15; 0.0.16; 0.0.17; 0.0.18; 0.0.19; 0.0.20

References

Timeline

Published: Nov 1, 2026
Last modified: Nov 2, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-1202366.3A vulnerability was detected in ag-ui-protocol ag-ui up to 0.0.58. Affected by this vulnerability is an unknown functionality of the compone CVE-2026-1202374.3A flaw has been found in ag-ui-protocol ag-ui up to 0.0.58. Affected by this issue is the function isInterruptExpired of the file sdks/types CVE-2026-1202389.9A vulnerability has been found in WAVLINK WN553X1-B 260403_2.0.0. This affects the function sub_4162A8 of the file /bin/ioos of the componen CVE-2026-1202399.9A vulnerability was found in WAVLINK WN553X1-B V260403_2.0.0. This vulnerability affects the function sub_419DA8 of the file /bin/ioos of th CVE-2026-120246.5Insufficient policy enforcement in DevTools in Google Chrome prior to 149.0.7827.115 allowed a remote attacker to bypass same origin policy CVE-2026-1202409.9A vulnerability was determined in WAVLINK WN553X1-B V260403_2.0.0. This issue affects the function sub_41A748 of the file /bin/ioos of the c CVE-2026-1202417.5A vulnerability was identified in Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P ESW_1.0(1)B1P48. Impacted is a CVE-2026-1202422.4A security flaw has been discovered in Ruijie RG-ES205GC, RG-ES206GC-P, RG-ES208GC, RG-ES210GC-LP and RG-ES210GS-P ESW_1.0(1)B1P48. The affe CVE-2026-1202435.5FFmpeg 2.0 through 9.0.2 contains a use of uninitialized variable vulnerability in the Go2Meeting decoder that allows attackers to leak stac CVE-2026-1202445.5FFmpeg 2.1 through 9.0.2 contains an uninitialized memory disclosure vulnerability in pcx_decode_frame() in libavcodec/pcx.c that leaves sca CVE-2026-1202455.5FFmpeg 0.10 through 9.0.2 contains an uninitialized memory disclosure vulnerability in sunrast_decode_frame() in libavcodec/sunrast.c that l CVE-2026-1202465.5FFmpeg 4.4 through 9.0.2 contains a use of uninitialized variable vulnerability in the CDXL decoder that leaks stack memory into decoded pix