The flaw resides in the DataContext.resolveSignal method of the a2ui component Resolver, where unvalidated input can cause the routine to allocate large amounts of memory or CPU time. This resource exhaustion can slow down or crash the application, effectively denying service to legitimate users. The weakness is classified as a resource exhaustion process (CWE-400) and a failure to handle missing resources (CWE-404).

The vulnerability affects a2ui-project's a2ui component up to version 0.10.6. The affected file is renderers/web_core/src/v0_9/rendering/data-context.ts within the Resolver module. The patch identified by commit c76e17272e52c12c6dcf68905b1df978c39e9aa5 resolves the issue.

The CVSS score of 6.9 indicates medium severity, and no EPSS score is available. The issue is not listed in CISA KEV. The attack vector is remote; an attacker can trigger the vulnerability from a network perspective without local access. Although no widespread public exploit has been reported beyond the proof‑of‑concept source, the availability of the fix demonstrates that exploitation is feasible.