{"id":"CVE-2026-92363","summary":"ag-ui-protocol ag-ui JSON sse_parser.cpp resource consumption","details":"A flaw has been found in ag-ui-protocol ag-ui 1.0. Affected is an unknown function of the file src/stream/sse_parser.cpp of the component JSON Parser. Executing a manipulation can lead to resource consumption. The attack may be performed from remote. This patch is called ab6e0bc298996caac2b4b0b3ec0bd8d32a15a186. Applying a patch is advised to resolve this issue.","modified":"2026-09-18T03:48:41.683990210Z","published":"2026-09-16T13:30:10.476Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92363.json","cna_assigner":"VulDB","cwe_ids":["CWE-400","CWE-404"]},"references":[{"type":"WEB","url":"https://github.com/ag-ui-protocol/ag-ui/"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/92xxx/CVE-2026-92363.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-92363"},{"type":"ADVISORY","url":"https://vuldb.com/cve/CVE-2026-92363"},{"type":"ADVISORY","url":"https://vuldb.com/submit/934957"},{"type":"ADVISORY","url":"https://vuldb.com/vuln/405449"},{"type":"REPORT","url":"https://github.com/ag-ui-protocol/ag-ui/issues/2440"},{"type":"REPORT","url":"https://vuldb.com/vuln/405449/cti"},{"type":"FIX","url":"https://github.com/ag-ui-protocol/ag-ui/commit/ab6e0bc298996caac2b4b0b3ec0bd8d32a15a186"},{"type":"FIX","url":"https://github.com/ag-ui-protocol/ag-ui/pull/2501"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/ag-ui-protocol/ag-ui","events":[{"introduced":"fd34acb6be63a67ed9dbbc7f2f59f7c6f8c01247"},{"fixed":"ab6e0bc298996caac2b4b0b3ec0bd8d32a15a186"}],"database_specific":{"source":["AFFECTED_FIELD","REFERENCES"],"extracted_events":[{"introduced":"1.0"},{"last_affected":"1.0"}]}}],"versions":["1.0","release/2026-08-20","@ag-ui/llamaindex@0.2.0","@ag-ui/crewai@0.0.4","@ag-ui/agno@0.0.6","release/2026-08-18","@ag-ui/ag2@0.0.2","release/2026-08-17","@ag-ui/pydantic-ai@0.0.3","ag-ui-langgraph@0.0.43","@ag-ui/mastra@1.1.2","@ag-ui/langgraph@0.0.43","release/2026-08-16","@ag-ui/langchain@0.0.3","release/2026-08-14","ag_ui_strands@0.3.0","release/2026-08-12","ag_ui_strands@0.2.5","release/2026-08-11","ag-ui-crewai@0.3.0","release/2026-08-07","AGUI.Server@0.0.5","AGUI.Protobuf@0.0.5","AGUI.Formatting@0.0.5","AGUI.Client@0.0.5","AGUI.Abstractions@0.0.5","java-server@0.1.0","java-core@0.1.0","java-client@0.1.0","release/2026-08-04","ag_ui_strands@0.2.4","release/2026-07-31","AGUI.ClaudeManagedAgents@0.0.1","release/2026-07-28","ag-ui-crewai@0.2.1","release/2026-07-22","ag_ui_strands@0.2.3","release/2026-07-15","AGUI.Server@0.0.4","AGUI.Protobuf@0.0.4","AGUI.Formatting@0.0.4","AGUI.Client@0.0.4","AGUI.Abstractions@0.0.4","release/2026-06-12","create-ag-ui-app@0.0.57","@ag-ui/proto@0.0.57","@ag-ui/encoder@0.0.57","@ag-ui/core@0.0.57","@ag-ui/client@0.0.57","release/2026-07-03","@ag-ui/mastra@1.1.1","@ag-ui/mastra@1.1.0","release/2026-07-02","AGUI.Server@0.0.3","AGUI.Protobuf@0.0.3","AGUI.Formatting@0.0.3","AGUI.Client@0.0.3","AGUI.Abstractions@0.0.3","release/2026-06-24","ag_ui_strands@0.2.2","@ag-ui/aws-strands@0.2.3","@ag-ui/aws-strands@0.2.2","release/2026-06-23","ag_ui_adk@0.7.0","release/2026-06-19","ag_ui_strands@0.2.1","ag-ui-langgraph@0.0.42","@ag-ui/langgraph@0.0.42","@ag-ui/aws-strands@0.2.1","@ag-ui/a2ui-middleware@0.0.10","release/2026-06-17","ag-ui-a2ui-toolkit@0.0.4","@ag-ui/a2ui-toolkit@0.0.4","@ag-ui/a2ui-middleware@0.0.9","release/2026-06-15","ag_ui_strands@0.2.0","@ag-ui/aws-strands@0.2.0","release/2026-06-04","ag-ui-langgraph@0.0.38","@ag-ui/langgraph@0.0.37","@ag-ui/a2ui-middleware@0.0.6","release/2026-06-09","create-ag-ui-app@0.0.56","ag-ui-langgraph@0.0.41","ag-ui-a2ui-toolkit@0.0.3","@ag-ui/proto@0.0.56","@ag-ui/langgraph@0.0.40","@ag-ui/encoder@0.0.56","@ag-ui/core@0.0.56","@ag-ui/client@0.0.56","release/2026-06-08","@ag-ui/langgraph@0.0.39","@ag-ui/a2ui-toolkit@0.0.2","@ag-ui/a2ui-middleware@0.0.8","ag-ui-claude-sdk@0.1.5","ag-ui-claude-sdk@0.1.4","ag-ui-claude-sdk@0.1.3","ag-ui-langgraph@0.0.39","@ag-ui/langgraph@0.0.38","@ag-ui/a2ui-middleware@0.0.7","ag-ui-langroid@0.1.1","ag-ui-agent-spec@0.1.1","ag-ui-claude-sdk@0.1.2","release/2026-06-05","@ag-ui/adk@0.0.2","@ag-ui/langgraph@0.0.36","ag-ui-protocol@0.1.19","release/2026-06-02","create-ag-ui-app@0.0.55","@ag-ui/proto@0.0.55","@ag-ui/encoder@0.0.55","@ag-ui/core@0.0.55","@ag-ui/client@0.0.55","ag-ui-langgraph@0.0.37","@ag-ui/langgraph@0.0.35","release/2026-05-29","create-ag-ui-app@0.0.54","@ag-ui/proto@0.0.54","@ag-ui/encoder@0.0.54","@ag-ui/core@0.0.54","@ag-ui/client@0.0.54","release/2026-05-28","ag_ui_adk@0.6.5","release/2026-05-27","@ag-ui/langgraph@0.0.34","@ag-ui/mastra@1.0.3","@ag-ui/langgraph@0.0.33","@ag-ui/langchain@0.0.2","@ag-ui/claude-agent-sdk@0.0.3"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-92363.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X"}]}