Threat intelligence dashboard
CVE-2026-101098medium

ag-ui-protocol ag-ui HTTP JdkAgentHttpHandler.java readAllBytes resource consumption

A security vulnerability has been detected in ag-ui-protocol ag-ui up to 2026-09-23. Affected by this issue is the function readAllBytes of the file JdkAgentHttpHandler.java of the component HTTP Handler. Such manipulation leads to resource consumption. The attack can be launched remotely. The pull request to fix this issue awaits acceptance.

Risk score

5.3

CVSS 4.0

Vendor
ag-ui-protocol
Product
ag-ui
CWE
CWE-400, CWE-404
Published
Sep 28, 2026
Updated
Sep 28, 2026
CISA KEV
Not flagged

Affected products and versions

ag-ui

ag-ui-protocol

Version / rangeStatusType
2026-09-23affected—

Technical metrics

5.3

CVSS 4.0

Severity
medium
Source
VulDB
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X

4.3

CVSS 3.1

Severity
medium
Source
VulDB
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C

4.3

CVSS 3.0

Severity
medium
Source
VulDB
Vector
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C

4.0

CVSS 2.0

Severity
medium
Source
VulDB
Vector
AV:N/AC:L/Au:S/C:N/I:N/A:P/E:ND/RL:ND/RC:C