The ag‑ui component receives HTTP requests through JdkAgentHttpHandler.java, which contains a readAllBytes method that can read arbitrary amounts of input without bounds. An attacker can send a crafted request that forces this method to consume large amounts of memory, potentially starving the process and causing it to become unresponsive or crash—a classic denial‑of‑service attack. This weakness corresponds to CWE‑400 (Resource Consumption) and CWE‑404 (Missing Resource Management).

ag‑ui by ag‑ui‑protocol, affecting all releases up through 2026‑09‑23.

The CVSS score of 5.3 indicates moderate severity; the EPSS score is currently unavailable and the vulnerability is not listed in the CISA KEV catalog. The attack can be launched remotely via the network, requiring only the ability to send HTTP requests to the vulnerable component. No known exploitation reports are present, but the lack of a hard limit on input size makes the vulnerability exploitable in theory.