CVE-2026-92114

Received Received - Intake

Inefficient Regular Expression Complexity in a2ui Basic Catalog

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: VulDB

Description

A vulnerability was identified in a2ui-project a2ui up to 0.10.6. Affected is an unknown function of the file renderers/web_core/src/v0_9/basic_catalog/functions/safe_regex.ts of the component Basic Catalog. Such manipulation leads to inefficient regular expression complexity. The attack can be launched remotely.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-15

Generated

2026-10-07

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-05

NVD

CVE-2026-92114

EUVD

EUVD-2026-80011

Affected Vendors & Products

Vendor	Product	Version / Range
a2ui-project	a2ui	to 0.10.6 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1333	The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability is in the a2ui-project a2ui software up to version 0.10.6. It involves a function in the file safe_regex.ts within the Basic Catalog component. The issue allows for inefficient regular expression complexity, which can be exploited remotely.

Impact Analysis

The vulnerability could allow an attacker to cause a denial of service by consuming excessive system resources through crafted regular expressions. This may lead to degraded performance or system unavailability.

Mitigation Strategies

Update the a2ui project to the latest version beyond 0.10.6 to address the inefficient regular expression complexity vulnerability in the Basic Catalog component.

Hi! I’m here to help you understand CVE-2026-92114. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70