CVE-2026-101098: ag-ui-protocol ag-ui DOS Vulnerability

CVE-2026-101098 Overview

CVE-2026-101098 is a resource consumption vulnerability [CWE-400] in the ag-ui-protocol ag-ui project. The flaw resides in the readAllBytes function within JdkAgentHttpHandler.java, part of the HTTP Handler component. Affected versions include all ag-ui releases up to 2026-09-23.

A remote attacker with low-level privileges can trigger unbounded resource consumption by sending crafted HTTP requests. Successful exploitation degrades service availability without impacting confidentiality or integrity. A pull request addressing this issue is currently pending upstream acceptance.

Critical Impact
Remote attackers can exhaust server resources through the HTTP Handler, causing availability degradation in applications built on the ag-ui protocol.

Affected Products

ag-ui-protocol ag-ui versions up to 2026-09-23
JdkAgentHttpHandler.java component (HTTP Handler)
Applications embedding the vulnerable ag-ui HTTP handler

Discovery Timeline

2026-09-28 - CVE-2026-101098 published to the National Vulnerability Database (NVD)
2026-09-28 - Last updated in NVD database

Technical Details for CVE-2026-101098

Vulnerability Analysis

The vulnerability affects the readAllBytes function inside JdkAgentHttpHandler.java, which handles incoming HTTP request bodies. The function reads the full request payload into memory without enforcing an explicit size limit or streaming boundary.

An attacker sending large or slow HTTP request bodies forces the handler to allocate memory proportional to the input. Repeated requests amplify resource consumption, exhausting heap memory or CPU cycles on the JVM hosting the ag-ui agent.

The issue is classified under CWE-400: Uncontrolled Resource Consumption. Exploitation only impacts availability; the CVSS vector indicates no impact on confidentiality or integrity of the target system.

Root Cause

The root cause is missing input size validation on inbound HTTP request bodies. The readAllBytes call reads all available bytes from the request InputStream into a byte array without checking Content-Length bounds or applying a maximum payload cap. This design permits pathological inputs to consume unbounded memory. See the pending fix in GitHub Pull Request #2671 and the tracking issue in GitHub Issue #2441.

Attack Vector

Exploitation requires network access to the ag-ui HTTP endpoint and a low-privileged authenticated context. An attacker sends HTTP requests with oversized bodies, or many concurrent requests, to the vulnerable handler. The JVM allocates heap memory during each readAllBytes invocation, and sustained requests drive the process toward memory exhaustion or garbage collection thrashing. No user interaction is required.

No verified public exploit code is available. See the VulDB entry for CVE-2026-101098 for additional context.

Detection Methods for CVE-2026-101098

Indicators of Compromise

Unusual spikes in JVM heap usage or garbage collection frequency on hosts running ag-ui agents
HTTP requests to the ag-ui endpoint with abnormally large Content-Length headers or oversized bodies
Elevated request rates from a single client toward the ag-ui HTTP handler followed by OutOfMemoryError traces

Detection Strategies

Instrument application logs to capture request body sizes handled by JdkAgentHttpHandler and alert on outliers
Monitor JVM metrics (heap, GC pauses, thread count) via APM tooling and correlate spikes with HTTP request patterns
Deploy a reverse proxy or web application firewall (WAF) in front of ag-ui to log and rate-limit large payload requests

Monitoring Recommendations

Track HTTP 5xx error rates and JVM OutOfMemoryError exceptions from ag-ui processes
Alert on sustained inbound traffic volume increases toward ag-ui endpoints from single source IPs
Correlate network telemetry with application-layer logs to identify slow-body or chunked-transfer abuse patterns

How to Mitigate CVE-2026-101098

Immediate Actions Required

Restrict network access to ag-ui HTTP endpoints to trusted clients only using firewall or ingress policies
Deploy a reverse proxy or WAF enforcing a maximum request body size (for example, 1 MB) upstream of ag-ui
Apply per-client rate limiting on the ag-ui HTTP endpoint to blunt sustained request floods

Patch Information

At the time of publication, no released patch is available. A fix is proposed in GitHub Pull Request #2671 and awaits upstream acceptance. Track the ag-ui repository and Issue #2441 for release status, and upgrade once a fixed version is published.

Workarounds

Terminate HTTP connections at a proxy that enforces client_max_body_size or equivalent request size caps
Configure connection and read timeouts on the fronting proxy to reject slow-body attacks
Isolate the ag-ui service in a container with strict memory limits so exhaustion is contained to the workload

bash

# Example NGINX reverse proxy configuration to cap request body size
server {
    listen 443 ssl;
    server_name agui.example.com;

    client_max_body_size 1m;
    client_body_timeout 10s;
    client_header_timeout 10s;

    limit_req_zone $binary_remote_addr zone=agui:10m rate=10r/s;

    location / {
        limit_req zone=agui burst=20 nodelay;
        proxy_pass http://agui_backend;
        proxy_read_timeout 30s;
    }
}