CVE-2026-101098: ag-ui-protocol ag-ui HTTP JdkAgentHttpHandler.java readAllBytes resource consumption

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-28 · updated 2026-09-28
Weakness: CWE-400

Description

A security vulnerability has been detected in ag-ui-protocol ag-ui up to 2026-09-23. Affected by this issue is the function readAllBytes of the file JdkAgentHttpHandler.java of the component HTTP Handler. Such manipulation leads to resource consumption. The attack can be launched remotely. The pull request to fix this issue awaits acceptance.

Affected products

ag-ui-protocol ag-ui: 2026-09-23

References

https://github.com/ag-ui-protocol/ag-ui/
https://github.com/ag-ui-protocol/ag-ui/issues/2441
https://github.com/ag-ui-protocol/ag-ui/pull/2671
https://vuldb.com/cve/CVE-2026-101098
https://vuldb.com/submit/934960
https://vuldb.com/vuln/410973
https://vuldb.com/vuln/410973/cti

Get alerted when CVE-2026-101098 or the next vulnerability affects your stack