CVE-2026-92361

A security vulnerability has been detected in ag-ui-protocol ag-ui 1.0. This affects an unknown function of the file sdks/community/go/pkg/client/sse/client.go of the component SSE Client. Such manipulation leads to resource consumption. The attack can be executed remotely. The pull request to fix this issue awaits acceptance.

CVSS v3 4.3 MEDIUM
CVSS v2.0 4.0 MEDIUM

4.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact LOW

Scope UNCHANGED

4.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:S/C:N/I:N/A:P

Exploitability : 8.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication SINGLE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact PARTIAL

References

Link	Resource
https://github.com/ag-ui-protocol/ag-ui/
https://github.com/ag-ui-protocol/ag-ui/issues/2438
https://github.com/ag-ui-protocol/ag-ui/pull/2700
https://vuldb.com/cve/CVE-2026-92361
https://vuldb.com/submit/934952
https://vuldb.com/vuln/405447
https://vuldb.com/vuln/405447/cti

Configurations

No configuration.

History

23 Sep 2026, 11:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de seguridad ha sido detectada en ag-ui-protocol ag-ui 1.0. Esto afecta una función desconocida del archivo sdks/community/go/pkg/cliente/sse/cliente.go del componente Cliente SSE. Dicha manipulación conduce al consumo de recursos. El ataque puede ser ejecutado remotamente. La solicitud de extracción para solucionar este problema espera ser aceptada.

16 Sep 2026, 13:18

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-09-16 13:18

Updated : 2026-09-28 21:10

NVD link : CVE-2026-92361

Mitre link : CVE-2026-92361

CVE.ORG link : CVE-2026-92361

JSON object : View

Products Affected

No product.

CWE

CWE-400

Uncontrolled Resource Consumption

CWE-404

Improper Resource Shutdown or Release

{"id": "CVE-2026-92361", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-92361", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-16T19:15:03.168748Z"}}], "cvssMetricV2": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"version": "2.0", "baseScore": 4.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:S/C:N/I:N/A:P", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "PARTIAL", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "cna@vuldb.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "cna@vuldb.com", "affectedData": [{"cpes": ["cpe:2.3:a:ag-ui-protocol:ag-ui:*:*:*:*:*:*:*:*"], "vendor": "ag-ui-protocol", "modules": ["SSE Client"], "product": "ag-ui", "versions": [{"status": "affected", "version": "1.0"}]}]}], "published": "2026-09-16T13:18:09.290", "references": [{"url": "https://github.com/ag-ui-protocol/ag-ui/", "source": "cna@vuldb.com"}, {"url": "https://github.com/ag-ui-protocol/ag-ui/issues/2438", "source": "cna@vuldb.com"}, {"url": "https://github.com/ag-ui-protocol/ag-ui/pull/2700", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/cve/CVE-2026-92361", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/submit/934952", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/405447", "source": "cna@vuldb.com"}, {"url": "https://vuldb.com/vuln/405447/cti", "source": "cna@vuldb.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "cna@vuldb.com", "description": [{"lang": "en", "value": "CWE-400"}, {"lang": "en", "value": "CWE-404"}]}], "descriptions": [{"lang": "en", "value": "A security vulnerability has been detected in ag-ui-protocol ag-ui 1.0. This affects an unknown function of the file sdks/community/go/pkg/client/sse/client.go of the component SSE Client. Such manipulation leads to resource consumption. The attack can be executed remotely. The pull request to fix this issue awaits acceptance."}, {"lang": "es", "value": "Una vulnerabilidad de seguridad ha sido detectada en ag-ui-protocol ag-ui 1.0. Esto afecta una funci\u00f3n desconocida del archivo sdks/community/go/pkg/cliente/sse/cliente.go del componente Cliente SSE. Dicha manipulaci\u00f3n conduce al consumo de recursos. El ataque puede ser ejecutado remotamente. La solicitud de extracci\u00f3n para solucionar este problema espera ser aceptada."}], "lastModified": "2026-09-28T21:10:00.140", "sourceIdentifier": "cna@vuldb.com"}