---
id: CVE-2026-120234
title: ag-ui-protocol ag-ui HTTP Transport e.text resource consumption
summary: >-
  A weakness has been identified in ag-ui-protocol ag-ui up to 0.0.58. This
  impacts the function e.text of the component HTTP Transport. Executing a
  manipulation can lead to resource consumption. The attack can be launched
  remotely. The ex…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C'
cvssSource: cna
cwe:
  - CWE-400
  - CWE-404
vendor: ag-ui-protocol
product: ag-ui
affected:
  - ag-ui 0.0.1
  - ag-ui 0.0.2
  - ag-ui 0.0.3
  - ag-ui 0.0.4
  - ag-ui 0.0.5
  - ag-ui 0.0.6
  - ag-ui 0.0.7
  - ag-ui 0.0.8
  - ag-ui 0.0.9
  - ag-ui 0.0.10
  - ag-ui 0.0.11
  - ag-ui 0.0.12
  - ag-ui 0.0.13
  - ag-ui 0.0.14
  - ag-ui 0.0.15
  - ag-ui 0.0.16
  - ag-ui 0.0.17
  - ag-ui 0.0.18
  - ag-ui 0.0.19
  - ag-ui 0.0.20
  - ag-ui 0.0.21
  - ag-ui 0.0.22
  - ag-ui 0.0.23
  - ag-ui 0.0.24
  - ag-ui 0.0.25
  - ag-ui 0.0.26
  - ag-ui 0.0.27
  - ag-ui 0.0.28
  - ag-ui 0.0.29
  - ag-ui 0.0.30
  - ag-ui 0.0.31
  - ag-ui 0.0.32
  - ag-ui 0.0.33
  - ag-ui 0.0.34
  - ag-ui 0.0.35
  - ag-ui 0.0.36
  - ag-ui 0.0.37
  - ag-ui 0.0.38
  - ag-ui 0.0.39
  - ag-ui 0.0.40
  - ag-ui 0.0.41
  - ag-ui 0.0.42
  - ag-ui 0.0.43
  - ag-ui 0.0.44
  - ag-ui 0.0.45
  - ag-ui 0.0.46
  - ag-ui 0.0.47
  - ag-ui 0.0.48
  - ag-ui 0.0.49
  - ag-ui 0.0.50
ssvc:
  exploitation: poc
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T19:07:04.622613Z'
exploitAvailable: true
published: '2026-11-01'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T19:07:18.398Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120234'
references:
  - url: 'https://vuldb.com/vuln/429593'
    label: >-
      VDB-429593 | ag-ui-protocol ag-ui HTTP Transport e.text resource
      consumption
  - url: 'https://vuldb.com/vuln/429593/cti'
    label: 'VDB-429593 | CTI Indicators (IOB, IOC, TTP, IOA)'
  - url: 'https://vuldb.com/cve/CVE-2026-120234'
    label: CVE-2026-120234 | CVE Analysis and Report
  - url: 'https://vuldb.com/submit/1015146'
    label: 'Submit #1015146 | ag-ui-protocol ag-ui <=0.0.58 CWE-400'
  - url: 'https://github.com/ag-ui-protocol/ag-ui/issues/2521'
  - url: 'https://github.com/ag-ui-protocol/ag-ui/pull/2698'
  - url: 'https://github.com/ag-ui-protocol/ag-ui/'
tags:
  - cve.org
  - exploit-available
epss: 0.00303
epssPercentile: 0.23181
ingestedAt: '2026-11-05T18:28:50.726Z'
---

## Overview

A weakness has been identified in ag-ui-protocol ag-ui up to 0.0.58. This impacts the function e.text of the component HTTP Transport. Executing a manipulation can lead to resource consumption. The attack can be launched remotely. The exploit has been made available to the public and could be used for attacks. The pull request to fix this issue awaits acceptance.

## Affected

- `ag-ui 0.0.1`
- `ag-ui 0.0.2`
- `ag-ui 0.0.3`
- `ag-ui 0.0.4`
- `ag-ui 0.0.5`
- `ag-ui 0.0.6`
- `ag-ui 0.0.7`
- `ag-ui 0.0.8`
- `ag-ui 0.0.9`
- `ag-ui 0.0.10`
- `ag-ui 0.0.11`
- `ag-ui 0.0.12`
- `ag-ui 0.0.13`
- `ag-ui 0.0.14`
- `ag-ui 0.0.15`
- `ag-ui 0.0.16`
- `ag-ui 0.0.17`
- `ag-ui 0.0.18`
- `ag-ui 0.0.19`
- `ag-ui 0.0.20`
- `ag-ui 0.0.21`
- `ag-ui 0.0.22`
- `ag-ui 0.0.23`
- `ag-ui 0.0.24`
- `ag-ui 0.0.25`
- `ag-ui 0.0.26`
- `ag-ui 0.0.27`
- `ag-ui 0.0.28`
- `ag-ui 0.0.29`
- `ag-ui 0.0.30`
- `ag-ui 0.0.31`
- `ag-ui 0.0.32`
- `ag-ui 0.0.33`
- `ag-ui 0.0.34`
- `ag-ui 0.0.35`
- `ag-ui 0.0.36`
- `ag-ui 0.0.37`
- `ag-ui 0.0.38`
- `ag-ui 0.0.39`
- `ag-ui 0.0.40`
- `ag-ui 0.0.41`
- `ag-ui 0.0.42`
- `ag-ui 0.0.43`
- `ag-ui 0.0.44`
- `ag-ui 0.0.45`
- `ag-ui 0.0.46`
- `ag-ui 0.0.47`
- `ag-ui 0.0.48`
- `ag-ui 0.0.49`
- `ag-ui 0.0.50`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.