CVE-2026-92363: ag-ui-protocol ag-ui DOS Vulnerability

CVE-2026-92363 Overview

CVE-2026-92363 is a resource consumption vulnerability in ag-ui-protocol ag-ui 1.0. The flaw resides in the JSON Parser component, specifically within the src/stream/sse_parser.cpp source file. An attacker can trigger uncontrolled resource consumption by sending crafted Server-Sent Events (SSE) input to the parser. The attack can be executed remotely and requires low privileges with no user interaction. The maintainers addressed the issue in commit ab6e0bc298996caac2b4b0b3ec0bd8d32a15a186, and applying the patch is advised. The vulnerability is categorized under [CWE-400] (Uncontrolled Resource Consumption).

Critical Impact
Remote attackers can exhaust server memory by streaming unterminated SSE events, degrading availability of applications relying on the ag-ui C++ SDK.

Affected Products

ag-ui-protocol ag-ui 1.0
ag-ui C++ SDK (sdks/community/c++)
Applications embedding the SseParser component from the ag-ui project

Discovery Timeline

2026-09-16 - CVE-2026-92363 published to NVD
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-92363

Vulnerability Analysis

The vulnerability affects the SSE parser inside the ag-ui C++ SDK. The SseParser::feed() function accepts streamed chunks and appends them to an internal buffer m_buffer prior to processing. The pre-patch implementation checked only m_buffer.size() + chunk.size() against kMaxBufferSize. This check ignored the per-event accumulator m_currentData, which retains bytes across chunks until an event terminator arrives.

An attacker able to reach the parser over the network can stream an unterminated SSE event as many small chunks. Because processBuffer() erases consumed bytes from m_buffer, the primary buffer stays small while m_currentData grows without bound. The result is memory exhaustion of the host process, producing a denial-of-service condition against services embedding the ag-ui SDK.

Root Cause

The root cause is an incomplete buffer size check. The size ceiling did not account for the per-event accumulator, allowing bounded per-chunk memory usage while unbounded aggregate growth occurred in a separate buffer. This is a classic [CWE-400] resource consumption issue.

Attack Vector

Exploitation requires network access to an endpoint that consumes SSE streams through the vulnerable SseParser. An authenticated low-privileged client can open an SSE connection and emit a long stream of small chunks that never contain an event delimiter. Integrity and confidentiality are not affected; only availability is impacted.

cpp

// Security patch in sdks/community/c++/src/stream/sse_parser.cpp
 namespace agui {
 
 void SseParser::feed(const std::string& chunk) {
-    // Check buffer size limit to prevent memory exhaustion
-    if (m_buffer.size() + chunk.size() > kMaxBufferSize) {
+    // Check buffer size limit to prevent memory exhaustion.
+    // m_currentData is included because processBuffer() erases consumed bytes
+    // from m_buffer, so a single unterminated event delivered as many small
+    // chunks would otherwise keep m_buffer small while the per-event
+    // accumulator grew without bound.
+    if (m_buffer.size() + m_currentData.size() + chunk.size() > kMaxBufferSize) {
         throw SseBufferExceededError(
             "SSE buffer size exceeded maximum limit of " + 
             std::to_string(kMaxBufferSize / (1024 * 1024)) + " MB");

Source: GitHub Commit ab6e0bc

Detection Methods for CVE-2026-92363

Indicators of Compromise

Sustained SSE connections from a single client that never emit event terminators (\n\n).
Process resident set size (RSS) growth on services embedding the ag-ui C++ SDK without a matching increase in completed events.
Application logs or crashes referencing SseBufferExceededError after applying the patch, indicating attempted exploitation.

Detection Strategies

Instrument the SSE ingestion path to record per-connection buffered bytes and alert when a single stream accumulates near kMaxBufferSize.
Correlate long-lived SSE connections with high memory allocation rates in the hosting process.
Deploy application-layer proxies that enforce a maximum event size and terminate streams exceeding it.

Monitoring Recommendations

Monitor host memory utilization on services running the ag-ui C++ SDK and alert on sudden growth trends.
Track SSE endpoint traffic for anomalous chunking patterns, such as many sub-kilobyte writes over a single connection.
Capture and review stack traces or exceptions from SseParser in centralized logging to identify exploitation attempts.

How to Mitigate CVE-2026-92363

Immediate Actions Required

Update the ag-ui C++ SDK to the revision containing commit ab6e0bc298996caac2b4b0b3ec0bd8d32a15a186 and rebuild dependent binaries.
Restrict SSE endpoints to authenticated clients and apply rate limits per source address.
Review deployed services for exposure of the vulnerable parser to untrusted networks.

Patch Information

The fix is available in the ag-ui project via GitHub Pull Request #2501 and merged as commit ab6e0bc298996caac2b4b0b3ec0bd8d32a15a186. The issue was tracked as GitHub Issue #2440. Additional analysis is available at VulDB CVE-2026-92363.

Workarounds

Place an ingress proxy in front of SSE endpoints that enforces maximum request duration and body size.
Lower kMaxBufferSize in local builds if operational constraints permit, reducing the memory ceiling per connection.
Terminate SSE connections that remain open beyond a defined time or byte threshold without producing a completed event.

bash

# Example nginx configuration to cap SSE stream duration and body size
location /events {
    proxy_pass http://ag_ui_backend;
    proxy_buffering off;
    proxy_read_timeout 60s;
    client_max_body_size 1m;
    limit_req zone=sse burst=10 nodelay;
}