This vulnerability arises from a flaw in the generic-binder.ts file of the a2ui project’s Binder component, allowing an attacker to manipulate the renderer and trigger excessive resource consumption. The resulting denial of service can degrade or halt the availability of the affected application, potentially affecting all users who rely on the component. The weakness is classified under CWE-400 (Resource Exhaustion) and CWE-404, indicating that the code fails to properly validate and handle inputs that could lead to excessive use of system resources.

The issue affects the a2ui project’s a2ui package for all releases up to and including version 0.10.6. The vulnerability is tied to the repository’s generic-binder.ts implementation and presents itself in the renderers/web_core/src/v0_9/rendering directory. Users of releases older than the commit identified as c97f4a02d3fea33ce3e9de5cf3fd0e3b8f3a4f0e should be aware that updates after this commit contain the applied fix.

The published CVSS score of 5.3 indicates a moderate impact. The exploit is remote, as the description explicitly states that an attacker can initiate the attack from outside the local network. While the EPSS score is not available and the flaw is not listed in CISA’s KEV catalog, the lack of a publicly known exploit does not negate the necessity for remediation; an attacker with sufficient resources could exploit the resource exhaustion to create a denial of service condition.