Login Request a demo
Medium severity · published Sep 28, 2026
CVE-2026-101098
ag-ui-protocol ag-ui HTTP JdkAgentHttpHandler.java readAllBytes resource consumption
4.3
CVSS
0.3%
EPSS
No
On KEV
Description
A security vulnerability has been detected in ag-ui-protocol ag-ui up to 2026-09-23. Affected by this issue is the function readAllBytes of the file JdkAgentHttpHandler.java of the component HTTP Handler. Such manipulation leads to resource consumption. The attack can be launched remotely. The pull request to fix this issue awaits acceptance.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 23% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AG
ag-ui · ag-ui-protocol
2026-09-23 · source: vendor
Affected product
AG
ag-ui
ag-ui-protocol
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-101098
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-101098
vdb-entry
https://vuldb.com/vuln/410973
signature
https://vuldb.com/vuln/410973/cti
third-party-advisory
https://vuldb.com/cve/CVE-2026-101098
third-party-advisory
https://vuldb.com/submit/934960
issue-tracking
https://github.com/ag-ui-protocol/ag-ui/issues/2441
issue-tracking
https://github.com/ag-ui-protocol/ag-ui/pull/2671
More from ag-ui
7.3
CVE-2026-92362
ag-ui-protocol ag-ui SSE Frame sse.rs resource consumption
6.3
CVE-2026-92360
ag-ui-protocol ag-ui Event Application Layer agent.ts prepareRunAgentInput origin validation
6.3
CVE-2026-92184
ag-ui-protocol ag-ui Multimodal Content utils.py urllib.request.urlopen server-side request forgery
5.4
CVE-2026-101100
ag-ui-protocol ag-ui Middleware filter-tool-calls.ts FilterToolCallsMiddleware cleanup
4.3
CVE-2026-101101
ag-ui-protocol ag-ui Middleware convert.ts JSON.parse uncaught exception