CVE-2026-92362: ag-ui SSE Frame Parser DoS Vulnerability

CVE-2026-92362 Overview

CVE-2026-92362 affects the ag-ui-protocol/ag-ui project version 1.0, specifically the Server-Sent Events (SSE) frame parser implemented in crates/ag-ui-client/src/sse.rs. The flaw allows a remote attacker to trigger uncontrolled resource consumption [CWE-400] by sending crafted input to the parser. Exploitation requires no authentication and no user interaction, and can be performed over the network. At the time of publication, the pull request fixing the issue awaits acceptance upstream.

Critical Impact
Remote, unauthenticated attackers can exhaust client resources through the SSE frame parser, degrading availability of applications that embed the ag-ui client.

Affected Products

ag-ui-protocol/ag-ui version 1.0
Rust crate ag-ui-client (module crates/ag-ui-client/src/sse.rs)
Downstream applications that embed the ag-ui SSE client for agent-UI communication

Discovery Timeline

2026-09-16 - CVE-2026-92362 published to the National Vulnerability Database (NVD)
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92362

Vulnerability Analysis

The vulnerability resides in the SSE frame parser inside crates/ag-ui-client/src/sse.rs. Server-Sent Events is a unidirectional streaming protocol where servers push text-based event frames to clients over HTTP. The ag-ui client consumes these frames to drive its agent-UI protocol.

An attacker who can influence the SSE stream, either by controlling the upstream server or by intercepting an unauthenticated channel, can craft frames that force the parser into an expensive processing path. The result is uncontrolled resource consumption on the client side.

Because the parsing logic runs before higher-level protocol validation, the abuse occurs early in the request lifecycle. This limits the effectiveness of application-layer input checks and pushes the impact directly onto CPU or memory resources of the host process.

Root Cause

The root cause is classified under [CWE-400] Uncontrolled Resource Consumption. The parser does not enforce sufficient bounds or backpressure when handling adversarial SSE frame input. Malformed or oversized frames are processed without limits that would otherwise protect the client from denial-of-service conditions.

Attack Vector

Exploitation is remote and requires no privileges or user interaction. An attacker sends manipulated SSE frames to any client that connects to a controlled or compromised event source. Sustained delivery of hostile frames can degrade responsiveness of the embedding application. The public references, including the GitHub Issue #2439 and VulDB CVE-2026-92362 entry, describe the abuse path.

No verified proof-of-concept code is published with the advisory. See the linked issue and pull request for technical details.

Detection Methods for CVE-2026-92362

Indicators of Compromise

Sustained high CPU or memory utilization in processes that link against the ag-ui-client crate while an SSE connection is active
Abnormally large or malformed SSE frames observed in HTTP response bodies from event source endpoints
Repeated reconnections or watchdog restarts of applications embedding the ag-ui client

Detection Strategies

Instrument the ag-ui client host process with resource metrics and alert on parser threads that hold CPU above baseline for extended intervals
Inspect SSE traffic at network egress for frames that violate expected size, field count, or encoding constraints
Correlate outbound connections to untrusted or newly observed event source hosts with local resource spikes

Monitoring Recommendations

Log SSE endpoint URLs, frame counts, and byte totals per session to establish a behavioral baseline
Enable process-level telemetry (CPU, RSS, thread count) for services embedding ag-ui-client and forward to your SIEM
Track upstream advisories on the ag-ui GitHub repository and the associated Pull Request #2500 for fix status

How to Mitigate CVE-2026-92362

Immediate Actions Required

Inventory all Rust applications that depend on the ag-ui-client crate at version 1.0
Restrict outbound SSE connections to trusted, authenticated event source hosts only
Apply network-level rate limiting and size caps on SSE responses reaching vulnerable clients
Monitor the upstream Pull Request #2500 and apply the fix once merged

Patch Information

At the time of publication, no official patched release is available. The upstream fix is proposed in Pull Request #2500 and awaits acceptance. Track the ag-ui GitHub repository for the next tagged release that incorporates the fix, and update Cargo.toml dependencies accordingly.

Workarounds

Terminate SSE streams behind a reverse proxy that enforces maximum response size, maximum event count, and idle timeouts
Isolate services that consume SSE from untrusted sources into sandboxes or containers with strict CPU and memory limits
Disable non-essential SSE integrations until an updated ag-ui-client release is available

bash

# Example: enforce resource limits on a service embedding ag-ui-client via systemd
# /etc/systemd/system/agui-consumer.service.d/limits.conf
[Service]
CPUQuota=50%
MemoryMax=512M
TasksMax=200
Restart=on-failure