Resource Consumption in ag-ui-protocol ag-ui

Executive Summary

This vulnerability is a memory exhaustion issue in the ag-ui-protocol library's TypeScript client. The problem occurs in the SSE Parser's parseSSEStream function and the protobuf decoder. Both components accumulate data without size limits, causing unbounded memory growth. For SSE streams, the parser stores unterminated response tails without trimming, leading to quadratic memory growth. For protobuf, the decoder grows buffers indefinitely when message length prefixes are never satisfied. A malicious response could consume excessive client memory and crash the application.

The fix introduces a 10 MB buffer size limit (MAX_BUFFER_SIZE) enforced before appending data. This prevents memory exhaustion while allowing normal operation for valid messages within the limit.

Useful 0 Not Useful 0

Detection Guidance

Check if your system uses ag-ui-protocol ag-ui version 0.0.58 or earlier. Inspect network traffic for unusually large or malformed SSE or protobuf streams. Monitor memory usage spikes during data processing.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow remote attackers to crash your application by sending specially crafted Server-Sent Events or protobuf messages. The attack consumes excessive client memory, potentially leading to denial-of-service conditions where the application becomes unresponsive or crashes entirely. Users may experience degraded performance or complete system failure when processing malicious data streams.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows remote attackers to cause resource consumption via unbounded buffer growth in SSE and protobuf decoders, potentially leading to denial-of-service or memory exhaustion. This could disrupt system availability, which may violate compliance requirements for GDPR (availability of processing systems) and HIPAA (availability of electronic protected health information systems).

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade ag-ui-protocol ag-ui to the latest version (2026-10-30 or later) which includes buffer size limits. Apply the patch commit 9e7b2b00bce215bbf731f1e6094f63812527c432 to enforce 10 MB buffer limits in SSE and protobuf decoders.

Useful 0 Not Useful 0