{"schema_version":"2","view":"grouped","data":[{"id":5239,"cve_ids":["CVE-2026-101099"],"payload":{"kind":"advisory","title":"ag-ui-protocol ag-ui Kotlin Community SDK SseParser.kt exceptional condition","summary":"A vulnerability was detected in ag-ui-protocol ag-ui up to 2026-09-23. This affects an unknown part of the file SseParser.kt of the component Kotlin Community SDK. Performing a manipulation results in handling of exceptional conditions. The attack may be initiated remotely. The pull request to fix this issue awaits acceptance.","evidence":"cve:CVE-2026-101099","products":[{"name":{"value":"ag-ui","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-101099","aliases":["CVE-2026-101099"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X"}},{"cvssV3_1":{"version":"3.1","baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":4,"vectorString":"AV:N/AC:L/Au:S/C:N/I:N/A:P/E:ND/RL:ND/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:ag-ui-protocol:ag-ui:*:*:*:*:*:*:*:*"],"vendor":"ag-ui-protocol","modules":["Kotlin Community SDK"],"product":"ag-ui","versions":[{"status":"affected","version":"2026-09-23"}]}],"modified":"2026-10-01T14:37:54.433Z","provider":"cve","references":["https://vuldb.com/vuln/410974","https://vuldb.com/vuln/410974/cti","https://vuldb.com/cve/CVE-2026-101099","https://vuldb.com/submit/934974","https://github.com/ag-ui-protocol/ag-ui/issues/2442","https://github.com/ag-ui-protocol/ag-ui/pull/2657","https://github.com/ag-ui-protocol/ag-ui/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-101099","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-01T14:37:44.354460Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T14:37:54.433Z"}}],"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-09-28T17:15:15.683Z"}}},"related_cves":[{"value":"CVE-2026-101099","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1a639727-c6d2-4cae-b546-3cc39d3284ad","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101099","advisory_id":"1a639727-c6d2-4cae-b546-3cc39d3284ad","event_types":["advisory"],"published_at":"2026-10-24T22:05:21.981088+00:00","technologies":["ag-ui","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T17:15:15.683+00:00","detail_url":"/advisories/advisory%3A1a639727-c6d2-4cae-b546-3cc39d3284ad","group":{"id":"advisory:1a639727-c6d2-4cae-b546-3cc39d3284ad","revision":1,"primary_event_id":5263,"change":"published","superseded_by":[],"changed":{"id":5263,"cve_ids":["CVE-2026-101099"],"payload":{"kind":"advisory","title":"ag-ui-protocol ag-ui Kotlin Community SDK SseParser.kt exceptional condition","summary":"A vulnerability was detected in ag-ui-protocol ag-ui up to 2026-09-23. This affects an unknown part of the file SseParser.kt of the component Kotlin Community SDK. Performing a manipulation results in handling of exceptional conditions. The attack may be initiated remotely. The pull request to fix this issue awaits acceptance.","evidence":"cve:CVE-2026-101099","products":[{"name":{"value":"ag-ui","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-101099","aliases":["CVE-2026-101099"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X"}},{"cvssV3_1":{"version":"3.1","baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":4,"vectorString":"AV:N/AC:L/Au:S/C:N/I:N/A:P/E:ND/RL:ND/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:ag-ui-protocol:ag-ui:*:*:*:*:*:*:*:*"],"vendor":"ag-ui-protocol","modules":["Kotlin Community SDK"],"product":"ag-ui","versions":[{"status":"affected","version":"2026-09-23"}]}],"modified":"2026-10-01T14:37:54.433Z","provider":"cve","references":["https://vuldb.com/vuln/410974","https://vuldb.com/vuln/410974/cti","https://vuldb.com/cve/CVE-2026-101099","https://vuldb.com/submit/934974","https://github.com/ag-ui-protocol/ag-ui/issues/2442","https://github.com/ag-ui-protocol/ag-ui/pull/2657","https://github.com/ag-ui-protocol/ag-ui/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-101099","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-01T14:37:44.354460Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T14:37:54.433Z"}}],"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-09-28T17:15:15.683Z"}}},"related_cves":[{"value":"CVE-2026-101099","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1a639727-c6d2-4cae-b546-3cc39d3284ad","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101099","advisory_id":"1a639727-c6d2-4cae-b546-3cc39d3284ad","event_types":["advisory"],"published_at":"2026-10-24T22:05:21.981088+00:00","technologies":["ag-ui","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T17:15:15.683+00:00","detail_url":"/events/5263"},"members":[{"id":5263,"cve_ids":["CVE-2026-101099"],"payload":{"kind":"advisory","title":"ag-ui-protocol ag-ui Kotlin Community SDK SseParser.kt exceptional condition","summary":"A vulnerability was detected in ag-ui-protocol ag-ui up to 2026-09-23. This affects an unknown part of the file SseParser.kt of the component Kotlin Community SDK. Performing a manipulation results in handling of exceptional conditions. The attack may be initiated remotely. The pull request to fix this issue awaits acceptance.","evidence":"cve:CVE-2026-101099","products":[{"name":{"value":"ag-ui","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-101099","aliases":["CVE-2026-101099"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X"}},{"cvssV3_1":{"version":"3.1","baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":4,"vectorString":"AV:N/AC:L/Au:S/C:N/I:N/A:P/E:ND/RL:ND/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:ag-ui-protocol:ag-ui:*:*:*:*:*:*:*:*"],"vendor":"ag-ui-protocol","modules":["Kotlin Community SDK"],"product":"ag-ui","versions":[{"status":"affected","version":"2026-09-23"}]}],"modified":"2026-10-01T14:37:54.433Z","provider":"cve","references":["https://vuldb.com/vuln/410974","https://vuldb.com/vuln/410974/cti","https://vuldb.com/cve/CVE-2026-101099","https://vuldb.com/submit/934974","https://github.com/ag-ui-protocol/ag-ui/issues/2442","https://github.com/ag-ui-protocol/ag-ui/pull/2657","https://github.com/ag-ui-protocol/ag-ui/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-101099","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-10-01T14:37:44.354460Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-10-01T14:37:54.433Z"}}],"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-09-28T17:15:15.683Z"}}},"related_cves":[{"value":"CVE-2026-101099","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1a639727-c6d2-4cae-b546-3cc39d3284ad","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101099","advisory_id":"1a639727-c6d2-4cae-b546-3cc39d3284ad","event_types":["advisory"],"published_at":"2026-10-24T22:05:21.981088+00:00","technologies":["ag-ui","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T17:15:15.683+00:00","detail_url":"/events/5263"}]}},{"id":3280,"cve_ids":["CVE-2026-101101"],"payload":{"kind":"advisory","title":"ag-ui-protocol ag-ui Middleware convert.ts JSON.parse uncaught exception","summary":"A vulnerability has been found in ag-ui-protocol ag-ui up to 2026-09-07. This issue affects the function JSON.parse of the file legacy/convert.ts of the component Middleware. The manipulation leads to uncaught exception. Remote exploitation of the attack is possible. Upgrading to version 2026-09-08 is capable of addressing this issue. The identifier of the patch is 30f8c794d5b73df5c610153043db502b2cc106cc. Upgrading the affected component is recommended.","evidence":"cve:CVE-2026-101101","products":[{"name":{"value":"ag-ui","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-101101","aliases":["CVE-2026-101101"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X"}},{"cvssV3_1":{"version":"3.1","baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":4,"vectorString":"AV:N/AC:L/Au:S/C:N/I:N/A:P/E:ND/RL:OF/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:ag-ui-protocol:ag-ui:*:*:*:*:*:*:*:*"],"vendor":"ag-ui-protocol","modules":["Middleware"],"product":"ag-ui","versions":[{"status":"affected","version":"2026-09-07"},{"status":"unaffected","version":"2026-09-08"}]}],"modified":"2026-09-28T18:13:33.954Z","provider":"cve","references":["https://vuldb.com/vuln/410976","https://vuldb.com/vuln/410976/cti","https://vuldb.com/cve/CVE-2026-101101","https://vuldb.com/submit/934981","https://github.com/ag-ui-protocol/ag-ui/issues/2444","https://github.com/ag-ui-protocol/ag-ui/pull/2493","https://github.com/ag-ui-protocol/ag-ui/commit/30f8c794d5b73df5c610153043db502b2cc106cc","https://github.com/ag-ui-protocol/ag-ui/releases/tag/release/2026-09-08","https://github.com/ag-ui-protocol/ag-ui/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-101101","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T18:13:26.343570Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T18:13:33.954Z"}}],"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-09-28T17:45:11.629Z"}}},"related_cves":[{"value":"CVE-2026-101101","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ed155af5-b193-48b0-bf12-5f5a2807094e","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101101","advisory_id":"ed155af5-b193-48b0-bf12-5f5a2807094e","event_types":["advisory"],"published_at":"2026-10-24T21:32:13.863926+00:00","technologies":["ag-ui","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T17:45:11.629+00:00","detail_url":"/advisories/advisory%3Aed155af5-b193-48b0-bf12-5f5a2807094e","group":{"id":"advisory:ed155af5-b193-48b0-bf12-5f5a2807094e","revision":1,"primary_event_id":3292,"change":"published","superseded_by":[],"changed":{"id":3292,"cve_ids":["CVE-2026-101101"],"payload":{"kind":"advisory","title":"ag-ui-protocol ag-ui Middleware convert.ts JSON.parse uncaught exception","summary":"A vulnerability has been found in ag-ui-protocol ag-ui up to 2026-09-07. This issue affects the function JSON.parse of the file legacy/convert.ts of the component Middleware. The manipulation leads to uncaught exception. Remote exploitation of the attack is possible. Upgrading to version 2026-09-08 is capable of addressing this issue. The identifier of the patch is 30f8c794d5b73df5c610153043db502b2cc106cc. Upgrading the affected component is recommended.","evidence":"cve:CVE-2026-101101","products":[{"name":{"value":"ag-ui","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-101101","aliases":["CVE-2026-101101"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X"}},{"cvssV3_1":{"version":"3.1","baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":4,"vectorString":"AV:N/AC:L/Au:S/C:N/I:N/A:P/E:ND/RL:OF/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:ag-ui-protocol:ag-ui:*:*:*:*:*:*:*:*"],"vendor":"ag-ui-protocol","modules":["Middleware"],"product":"ag-ui","versions":[{"status":"affected","version":"2026-09-07"},{"status":"unaffected","version":"2026-09-08"}]}],"modified":"2026-09-28T18:13:33.954Z","provider":"cve","references":["https://vuldb.com/vuln/410976","https://vuldb.com/vuln/410976/cti","https://vuldb.com/cve/CVE-2026-101101","https://vuldb.com/submit/934981","https://github.com/ag-ui-protocol/ag-ui/issues/2444","https://github.com/ag-ui-protocol/ag-ui/pull/2493","https://github.com/ag-ui-protocol/ag-ui/commit/30f8c794d5b73df5c610153043db502b2cc106cc","https://github.com/ag-ui-protocol/ag-ui/releases/tag/release/2026-09-08","https://github.com/ag-ui-protocol/ag-ui/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-101101","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T18:13:26.343570Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T18:13:33.954Z"}}],"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-09-28T17:45:11.629Z"}}},"related_cves":[{"value":"CVE-2026-101101","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ed155af5-b193-48b0-bf12-5f5a2807094e","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101101","advisory_id":"ed155af5-b193-48b0-bf12-5f5a2807094e","event_types":["advisory"],"published_at":"2026-10-24T21:32:13.863926+00:00","technologies":["ag-ui","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T17:45:11.629+00:00","detail_url":"/events/3292"},"members":[{"id":3292,"cve_ids":["CVE-2026-101101"],"payload":{"kind":"advisory","title":"ag-ui-protocol ag-ui Middleware convert.ts JSON.parse uncaught exception","summary":"A vulnerability has been found in ag-ui-protocol ag-ui up to 2026-09-07. This issue affects the function JSON.parse of the file legacy/convert.ts of the component Middleware. The manipulation leads to uncaught exception. Remote exploitation of the attack is possible. Upgrading to version 2026-09-08 is capable of addressing this issue. The identifier of the patch is 30f8c794d5b73df5c610153043db502b2cc106cc. Upgrading the affected component is recommended.","evidence":"cve:CVE-2026-101101","products":[{"name":{"value":"ag-ui","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-101101","aliases":["CVE-2026-101101"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X"}},{"cvssV3_1":{"version":"3.1","baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:O/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":4,"vectorString":"AV:N/AC:L/Au:S/C:N/I:N/A:P/E:ND/RL:OF/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:ag-ui-protocol:ag-ui:*:*:*:*:*:*:*:*"],"vendor":"ag-ui-protocol","modules":["Middleware"],"product":"ag-ui","versions":[{"status":"affected","version":"2026-09-07"},{"status":"unaffected","version":"2026-09-08"}]}],"modified":"2026-09-28T18:13:33.954Z","provider":"cve","references":["https://vuldb.com/vuln/410976","https://vuldb.com/vuln/410976/cti","https://vuldb.com/cve/CVE-2026-101101","https://vuldb.com/submit/934981","https://github.com/ag-ui-protocol/ag-ui/issues/2444","https://github.com/ag-ui-protocol/ag-ui/pull/2493","https://github.com/ag-ui-protocol/ag-ui/commit/30f8c794d5b73df5c610153043db502b2cc106cc","https://github.com/ag-ui-protocol/ag-ui/releases/tag/release/2026-09-08","https://github.com/ag-ui-protocol/ag-ui/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-101101","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T18:13:26.343570Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T18:13:33.954Z"}}],"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-09-28T17:45:11.629Z"}}},"related_cves":[{"value":"CVE-2026-101101","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:ed155af5-b193-48b0-bf12-5f5a2807094e","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101101","advisory_id":"ed155af5-b193-48b0-bf12-5f5a2807094e","event_types":["advisory"],"published_at":"2026-10-24T21:32:13.863926+00:00","technologies":["ag-ui","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T17:45:11.629+00:00","detail_url":"/events/3292"}]}},{"id":3257,"cve_ids":["CVE-2026-101100"],"payload":{"kind":"advisory","title":"ag-ui-protocol ag-ui Middleware filter-tool-calls.ts FilterToolCallsMiddleware cleanup","summary":"A flaw has been found in ag-ui-protocol ag-ui up to 2026-09-07. This vulnerability affects the function FilterToolCallsMiddleware of the file sdks/typescript/packages/client/src/middleware/filter-tool-calls.ts of the component Middleware. Executing a manipulation can lead to incomplete cleanup. The attack may be launched remotely. Upgrading to version 2026-09-08 is able to resolve this issue. This patch is called c346119fe870b70f5c19738ee5119f3e1456e59d. It is suggested to upgrade the affected component.","evidence":"cve:CVE-2026-101100","products":[{"name":{"value":"ag-ui","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-101100","aliases":["CVE-2026-101100"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X"}},{"cvssV3_1":{"version":"3.1","baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":5.5,"vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:P/E:ND/RL:OF/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:ag-ui-protocol:ag-ui:*:*:*:*:*:*:*:*"],"vendor":"ag-ui-protocol","modules":["Middleware"],"product":"ag-ui","versions":[{"status":"affected","version":"2026-09-07"},{"status":"unaffected","version":"2026-09-08"}]}],"modified":"2026-09-28T17:47:55.078Z","provider":"cve","references":["https://vuldb.com/vuln/410975","https://vuldb.com/vuln/410975/cti","https://vuldb.com/cve/CVE-2026-101100","https://vuldb.com/submit/934980","https://github.com/ag-ui-protocol/ag-ui/issues/2443","https://github.com/ag-ui-protocol/ag-ui/pull/2494","https://github.com/ag-ui-protocol/ag-ui/commit/c346119fe870b70f5c19738ee5119f3e1456e59d","https://github.com/ag-ui-protocol/ag-ui/releases/tag/release/2026-09-08","https://github.com/ag-ui-protocol/ag-ui/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-101100","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T17:47:46.613540Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T17:47:55.078Z"}}],"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-09-28T17:30:15.988Z"}}},"related_cves":[{"value":"CVE-2026-101100","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:c17a45ac-ab66-474e-ac92-452717099130","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101100","advisory_id":"c17a45ac-ab66-474e-ac92-452717099130","event_types":["advisory"],"published_at":"2026-10-24T21:31:59.562469+00:00","technologies":["ag-ui","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T17:30:15.988+00:00","detail_url":"/advisories/advisory%3Ac17a45ac-ab66-474e-ac92-452717099130","group":{"id":"advisory:c17a45ac-ab66-474e-ac92-452717099130","revision":1,"primary_event_id":3269,"change":"published","superseded_by":[],"changed":{"id":3269,"cve_ids":["CVE-2026-101100"],"payload":{"kind":"advisory","title":"ag-ui-protocol ag-ui Middleware filter-tool-calls.ts FilterToolCallsMiddleware cleanup","summary":"A flaw has been found in ag-ui-protocol ag-ui up to 2026-09-07. This vulnerability affects the function FilterToolCallsMiddleware of the file sdks/typescript/packages/client/src/middleware/filter-tool-calls.ts of the component Middleware. Executing a manipulation can lead to incomplete cleanup. The attack may be launched remotely. Upgrading to version 2026-09-08 is able to resolve this issue. This patch is called c346119fe870b70f5c19738ee5119f3e1456e59d. It is suggested to upgrade the affected component.","evidence":"cve:CVE-2026-101100","products":[{"name":{"value":"ag-ui","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-101100","aliases":["CVE-2026-101100"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X"}},{"cvssV3_1":{"version":"3.1","baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":5.5,"vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:P/E:ND/RL:OF/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:ag-ui-protocol:ag-ui:*:*:*:*:*:*:*:*"],"vendor":"ag-ui-protocol","modules":["Middleware"],"product":"ag-ui","versions":[{"status":"affected","version":"2026-09-07"},{"status":"unaffected","version":"2026-09-08"}]}],"modified":"2026-09-28T17:47:55.078Z","provider":"cve","references":["https://vuldb.com/vuln/410975","https://vuldb.com/vuln/410975/cti","https://vuldb.com/cve/CVE-2026-101100","https://vuldb.com/submit/934980","https://github.com/ag-ui-protocol/ag-ui/issues/2443","https://github.com/ag-ui-protocol/ag-ui/pull/2494","https://github.com/ag-ui-protocol/ag-ui/commit/c346119fe870b70f5c19738ee5119f3e1456e59d","https://github.com/ag-ui-protocol/ag-ui/releases/tag/release/2026-09-08","https://github.com/ag-ui-protocol/ag-ui/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-101100","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T17:47:46.613540Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T17:47:55.078Z"}}],"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-09-28T17:30:15.988Z"}}},"related_cves":[{"value":"CVE-2026-101100","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:c17a45ac-ab66-474e-ac92-452717099130","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101100","advisory_id":"c17a45ac-ab66-474e-ac92-452717099130","event_types":["advisory"],"published_at":"2026-10-24T21:31:59.562469+00:00","technologies":["ag-ui","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T17:30:15.988+00:00","detail_url":"/events/3269"},"members":[{"id":3269,"cve_ids":["CVE-2026-101100"],"payload":{"kind":"advisory","title":"ag-ui-protocol ag-ui Middleware filter-tool-calls.ts FilterToolCallsMiddleware cleanup","summary":"A flaw has been found in ag-ui-protocol ag-ui up to 2026-09-07. This vulnerability affects the function FilterToolCallsMiddleware of the file sdks/typescript/packages/client/src/middleware/filter-tool-calls.ts of the component Middleware. Executing a manipulation can lead to incomplete cleanup. The attack may be launched remotely. Upgrading to version 2026-09-08 is able to resolve this issue. This patch is called c346119fe870b70f5c19738ee5119f3e1456e59d. It is suggested to upgrade the affected component.","evidence":"cve:CVE-2026-101100","products":[{"name":{"value":"ag-ui","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-101100","aliases":["CVE-2026-101100"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X"}},{"cvssV3_1":{"version":"3.1","baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":5.4,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":5.5,"vectorString":"AV:N/AC:L/Au:S/C:N/I:P/A:P/E:ND/RL:OF/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:ag-ui-protocol:ag-ui:*:*:*:*:*:*:*:*"],"vendor":"ag-ui-protocol","modules":["Middleware"],"product":"ag-ui","versions":[{"status":"affected","version":"2026-09-07"},{"status":"unaffected","version":"2026-09-08"}]}],"modified":"2026-09-28T17:47:55.078Z","provider":"cve","references":["https://vuldb.com/vuln/410975","https://vuldb.com/vuln/410975/cti","https://vuldb.com/cve/CVE-2026-101100","https://vuldb.com/submit/934980","https://github.com/ag-ui-protocol/ag-ui/issues/2443","https://github.com/ag-ui-protocol/ag-ui/pull/2494","https://github.com/ag-ui-protocol/ag-ui/commit/c346119fe870b70f5c19738ee5119f3e1456e59d","https://github.com/ag-ui-protocol/ag-ui/releases/tag/release/2026-09-08","https://github.com/ag-ui-protocol/ag-ui/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-101100","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T17:47:46.613540Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T17:47:55.078Z"}}],"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-09-28T17:30:15.988Z"}}},"related_cves":[{"value":"CVE-2026-101100","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:c17a45ac-ab66-474e-ac92-452717099130","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101100","advisory_id":"c17a45ac-ab66-474e-ac92-452717099130","event_types":["advisory"],"published_at":"2026-10-24T21:31:59.562469+00:00","technologies":["ag-ui","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T17:30:15.988+00:00","detail_url":"/events/3269"}]}},{"id":3255,"cve_ids":["CVE-2026-101098"],"payload":{"kind":"advisory","title":"ag-ui-protocol ag-ui HTTP JdkAgentHttpHandler.java readAllBytes resource consumption","summary":"A security vulnerability has been detected in ag-ui-protocol ag-ui up to 2026-09-23. Affected by this issue is the function readAllBytes of the file JdkAgentHttpHandler.java of the component HTTP Handler. Such manipulation leads to resource consumption. The attack can be launched remotely. The pull request to fix this issue awaits acceptance.","evidence":"cve:CVE-2026-101098","products":[{"name":{"value":"ag-ui","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-101098","aliases":["CVE-2026-101098"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X"}},{"cvssV3_1":{"version":"3.1","baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":4,"vectorString":"AV:N/AC:L/Au:S/C:N/I:N/A:P/E:ND/RL:ND/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:ag-ui-protocol:ag-ui:*:*:*:*:*:*:*:*"],"vendor":"ag-ui-protocol","modules":["HTTP Handler"],"product":"ag-ui","versions":[{"status":"affected","version":"2026-09-23"}]}],"modified":"2026-09-28T17:48:21.413Z","provider":"cve","references":["https://vuldb.com/vuln/410973","https://vuldb.com/vuln/410973/cti","https://vuldb.com/cve/CVE-2026-101098","https://vuldb.com/submit/934960","https://github.com/ag-ui-protocol/ag-ui/issues/2441","https://github.com/ag-ui-protocol/ag-ui/pull/2671","https://github.com/ag-ui-protocol/ag-ui/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-101098","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T17:48:04.263858Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T17:48:21.413Z"}}],"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-09-28T17:00:16.182Z"}}},"related_cves":[{"value":"CVE-2026-101098","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1ae4c4f4-e0a7-404d-84d6-d2ca335735d2","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101098","advisory_id":"1ae4c4f4-e0a7-404d-84d6-d2ca335735d2","event_types":["advisory"],"published_at":"2026-10-24T21:31:58.231297+00:00","technologies":["ag-ui","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T17:00:16.182+00:00","detail_url":"/advisories/advisory%3A1ae4c4f4-e0a7-404d-84d6-d2ca335735d2","group":{"id":"advisory:1ae4c4f4-e0a7-404d-84d6-d2ca335735d2","revision":1,"primary_event_id":3267,"change":"published","superseded_by":[],"changed":{"id":3267,"cve_ids":["CVE-2026-101098"],"payload":{"kind":"advisory","title":"ag-ui-protocol ag-ui HTTP JdkAgentHttpHandler.java readAllBytes resource consumption","summary":"A security vulnerability has been detected in ag-ui-protocol ag-ui up to 2026-09-23. Affected by this issue is the function readAllBytes of the file JdkAgentHttpHandler.java of the component HTTP Handler. Such manipulation leads to resource consumption. The attack can be launched remotely. The pull request to fix this issue awaits acceptance.","evidence":"cve:CVE-2026-101098","products":[{"name":{"value":"ag-ui","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-101098","aliases":["CVE-2026-101098"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X"}},{"cvssV3_1":{"version":"3.1","baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":4,"vectorString":"AV:N/AC:L/Au:S/C:N/I:N/A:P/E:ND/RL:ND/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:ag-ui-protocol:ag-ui:*:*:*:*:*:*:*:*"],"vendor":"ag-ui-protocol","modules":["HTTP Handler"],"product":"ag-ui","versions":[{"status":"affected","version":"2026-09-23"}]}],"modified":"2026-09-28T17:48:21.413Z","provider":"cve","references":["https://vuldb.com/vuln/410973","https://vuldb.com/vuln/410973/cti","https://vuldb.com/cve/CVE-2026-101098","https://vuldb.com/submit/934960","https://github.com/ag-ui-protocol/ag-ui/issues/2441","https://github.com/ag-ui-protocol/ag-ui/pull/2671","https://github.com/ag-ui-protocol/ag-ui/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-101098","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T17:48:04.263858Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T17:48:21.413Z"}}],"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-09-28T17:00:16.182Z"}}},"related_cves":[{"value":"CVE-2026-101098","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1ae4c4f4-e0a7-404d-84d6-d2ca335735d2","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101098","advisory_id":"1ae4c4f4-e0a7-404d-84d6-d2ca335735d2","event_types":["advisory"],"published_at":"2026-10-24T21:31:58.231297+00:00","technologies":["ag-ui","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T17:00:16.182+00:00","detail_url":"/events/3267"},"members":[{"id":3267,"cve_ids":["CVE-2026-101098"],"payload":{"kind":"advisory","title":"ag-ui-protocol ag-ui HTTP JdkAgentHttpHandler.java readAllBytes resource consumption","summary":"A security vulnerability has been detected in ag-ui-protocol ag-ui up to 2026-09-23. Affected by this issue is the function readAllBytes of the file JdkAgentHttpHandler.java of the component HTTP Handler. Such manipulation leads to resource consumption. The attack can be launched remotely. The pull request to fix this issue awaits acceptance.","evidence":"cve:CVE-2026-101098","products":[{"name":{"value":"ag-ui","evidence":"/containers/cna/affected/0/product"},"prerequisites":[],"fixed_versions":[],"affected_versions":[]}],"severity":"medium","structured":{"id":"CVE-2026-101098","aliases":["CVE-2026-101098"],"metrics":[{"cvssV4_0":{"version":"4.0","baseScore":5.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X"}},{"cvssV3_1":{"version":"3.1","baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C"}},{"cvssV3_0":{"version":"3.0","baseScore":4.3,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:X/RL:X/RC:C"}},{"cvssV2_0":{"version":"2.0","baseScore":4,"vectorString":"AV:N/AC:L/Au:S/C:N/I:N/A:P/E:ND/RL:ND/RC:C"}}],"affected":[{"cpes":["cpe:2.3:a:ag-ui-protocol:ag-ui:*:*:*:*:*:*:*:*"],"vendor":"ag-ui-protocol","modules":["HTTP Handler"],"product":"ag-ui","versions":[{"status":"affected","version":"2026-09-23"}]}],"modified":"2026-09-28T17:48:21.413Z","provider":"cve","references":["https://vuldb.com/vuln/410973","https://vuldb.com/vuln/410973/cti","https://vuldb.com/cve/CVE-2026-101098","https://vuldb.com/submit/934960","https://github.com/ag-ui-protocol/ag-ui/issues/2441","https://github.com/ag-ui-protocol/ag-ui/pull/2671","https://github.com/ag-ui-protocol/ag-ui/"],"provider_metadata":{"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-101098","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"version":"2.0.3","timestamp":"2026-09-28T17:48:04.263858Z"}}}],"providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2026-09-28T17:48:21.413Z"}}],"cna":{"orgId":"1af790b2-7ee1-4545-860a-a788eba489b5","shortName":"VulDB","dateUpdated":"2026-09-28T17:00:16.182Z"}}},"related_cves":[{"value":"CVE-2026-101098","evidence":"/cveMetadata/cveId"}],"security_relevant":true,"severity_evidence":"/containers/cna/metrics"},"group_id":"advisory:1ae4c4f4-e0a7-404d-84d6-d2ca335735d2","priority":{"reasons":[],"severity":"medium","linked_cves":[],"fix_available":false,"known_exploited":false,"publisher_severity":"medium"},"revision":1,"source_id":"core-cve","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101098","advisory_id":"1ae4c4f4-e0a7-404d-84d6-d2ca335735d2","event_types":["advisory"],"published_at":"2026-10-24T21:31:58.231297+00:00","technologies":["ag-ui","core-cve"],"context_update":false,"extraction_method":"structured","source_published_at":"2026-09-28T17:00:16.182+00:00","detail_url":"/events/3267"}]}}],"next_after":5239,"next_before":3255}