Copyright © 2012 Red Hat, Inc. All rights reserved. Moderate 2026-09-28T17:45:11 ag-ui: ag-ui: Denial of Service via uncaught JSON parsing exception 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L CWE-248

A vulnerability has been found in ag-ui-protocol ag-ui up to 2026-09-07. This issue affects the function JSON.parse of the file legacy/convert.ts of the component Middleware. The manipulation leads to uncaught exception. Remote exploitation of the attack is possible. Upgrading to version 2026-09-08 is capable of addressing this issue. The identifier of the patch is 30f8c794d5b73df5c610153043db502b2cc106cc. Upgrading the affected component is recommended.

A flaw was found in ag-ui. A remote authenticated attacker can trigger an uncaught exception during JSON parsing by submitting malformed input to the middleware component. This failure can cause the application to crash unexpectedly, resulting in a Denial of Service (DoS).

A flaw was found in ag-ui within the middleware JSON parsing component (`legacy/convert.ts`). A remote authenticated attacker can submit malformed JSON input, triggering an uncaught exception during `JSON.parse`. This causes the process to crash unexpectedly, resulting in a Denial of Service (DoS). Default container execution controls and service managers may mitigate impact by automatically restarting the affected service process. Restrict network access or revoke privileges for untrusted authenticated users accessing the middleware endpoint. Additionally, deploy request-filtering proxies to validate or reject malformed JSON payloads prior to reaching the application middleware. Red Hat Hardened Images Not affected jaeger https://www.cve.org/CVERecord?id=CVE-2026-101101 https://nvd.nist.gov/vuln/detail/CVE-2026-101101 https://github.com/ag-ui-protocol/ag-ui/ https://github.com/ag-ui-protocol/ag-ui/commit/30f8c794d5b73df5c610153043db502b2cc106cc https://github.com/ag-ui-protocol/ag-ui/issues/2444 https://github.com/ag-ui-protocol/ag-ui/pull/2493 https://github.com/ag-ui-protocol/ag-ui/releases/tag/release/2026-09-08 https://vuldb.com/cve/CVE-2026-101101 https://vuldb.com/submit/934981 https://vuldb.com/vuln/410976 https://vuldb.com/vuln/410976/cti