Resource Consumption in ag-ui-protocol ag-ui

Executive Summary

This vulnerability involves the ag-ui client library (version 0.0.58) where error responses are fully read into memory without size limits. When an HTTP request fails, the library uses e.text() to buffer the entire error body, which can cause out-of-memory conditions if the response is large. The issue stems from inconsistent handling between success and error paths.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, monitor for unusual memory consumption patterns in applications using ag-ui-protocol ag-ui up to 0.0.58. Check for processes handling large HTTP error responses that may cause resource exhaustion. Use system monitoring tools like top, htop, or ps to observe memory usage spikes during HTTP requests.

Useful 0 Not Useful 0

Impact Analysis

An attacker could exploit this by sending a large error response (e.g., 50 MB), causing the application to consume excessive memory and potentially crash. Additionally, the full error body may be exposed in logs or UI, leading to information disclosure or log pollution.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling resource exhaustion attacks that disrupt system availability, potentially violating availability requirements in both regulations. Additionally, if error responses containing sensitive data are exposed through logs or UI due to unbounded memory consumption, it may lead to unauthorized information disclosure, violating GDPR's data protection principles and HIPAA's confidentiality requirements.

Useful 0 Not Useful 0

Mitigation Strategies

• Upgrade ag-ui-protocol ag-ui to the latest version that includes the fix for CVE-2026-120234.
• Implement network-level protections to block or limit the size of HTTP error responses from untrusted sources.
• Review and update error handling logic in applications to use streaming mechanisms with size limits for error responses.

Useful 0 Not Useful 0