CVE-2026-101100

ag-ui-protocol ag-ui Middleware filter-tool-calls.ts FilterToolCallsMiddleware cleanup

View on CVE.org
Published Sep 28, 2026 CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Description
A flaw has been found in ag-ui-protocol ag-ui up to 2026-09-07. This vulnerability affects the function FilterToolCallsMiddleware of the file sdks/typescript/packages/client/src/middleware/filter-tool-calls.ts of the component Middleware. Executing a manipulation can lead to incomplete cleanup. The attack may be launched remotely. Upgrading to version 2026-09-08 is able to resolve this issue. This patch is called c346119fe870b70f5c19738ee5119f3e1456e59d. It is suggested to upgrade the affected component.

Analysis

AI-generated

Technical impact

A flaw in the ag-ui Middleware FilterToolCallsMiddleware causes an incomplete cleanup of resources, which can lead to resource exhaustion and degraded service availability. The vulnerability is classified as CWE‑459, indicating an improper release of resources. Attackers may exploit the flaw by manipulating input to trigger the middleware without proper cleanup, potentially compromising the stability of the application.

Affected Systems

The affected product is ag‑ui from ag‑ui‑protocol. Versions up to and including 2026‑09‑07 contain the flaw. The patch that fixes the issue is released as version 2026‑09‑08 and incorporates commit c346119fe870b70f5c19738ee5119f3e1456e59d.

Risk and Exploitability

The CVSS score of 5.3 reflects moderate severity, while the EPSS score is not currently available. The vulnerability is not listed in the CISA KEV catalog. Based on the description, the attack can be launched remotely by executing specially crafted input that triggers the middleware path. The exploit requires the ability to influence input to the middleware; no local privilege escalation is required. The impact is limited to denial of service rather than confidentiality or integrity breaches.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade ag-ui to the patched release 2026‑09‑08
  • If an immediate upgrade is not possible, temporarily disable the FilterToolCallsMiddleware or route requests around it
  • Reduce the size or complexity of data passed through the middleware until the patch is applied

Generated by OpenCVE AI on September 28, 2026 at 18:26 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A flaw has been found in ag-ui-protocol ag-ui up to 2026-09-07. This vulnerability affects the function FilterToolCallsMiddleware of the file sdks/typescript/packages/client/src/middleware/filter-tool-calls.ts of the component Middleware. Executing a manipulation can lead to incomplete cleanup. The attack may be launched remotely. Upgrading to version 2026-09-08 is able to resolve this issue. This patch is called c346119fe870b70f5c19738ee5119f3e1456e59d. It is suggested to upgrade the affected component.
Title ag-ui-protocol ag-ui Middleware filter-tool-calls.ts FilterToolCallsMiddleware cleanup
First Time appeared Ag-ui-protocol
Ag-ui-protocol ag-ui
Weaknesses CWE-459
CPEs cpe:2.3:a:ag-ui-protocol:ag-ui:*:*:*:*:*:*:*:*
Vendors & Products Ag-ui-protocol
Ag-ui-protocol ag-ui
References
Metrics cvssV2_0

{'score': 5.5, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:P/E:ND/RL:OF/RC:C'}

cvssV3_0

{'score': 5.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C'}

cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:X/RL:O/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 28, 2026, 5:47 PM
Reserved
Sep 28, 2026, 2:53 AM

View source JSON

Updated
Sep 28, 2026, 5:47 PM

JSON

Status
Deferred
Published
Sep 28, 2026, 6:17 PM
Modified
Sep 28, 2026, 9:03 PM

View source JSON

Severity
Moderate
Public date
Sep 28, 2026, 5:30 PM

View source Bugzilla JSON

Updated
Sep 28, 2026, 7:15 PM

JSON