Is CVE-2026-118271 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118271 being exploited in the wild.

How severe is CVE-2026-118271?

Medium severity, with a CVSS score of 4.3, published 28 October 2026.

Which products and versions are affected?

A2ui-Project A2ui up to 0.10.6.

Is there a fix for CVE-2026-118271?

Yes: fixed in Commit eb314e14fabd29cfb4a74e1202afc4fe2081efa2 (2026-09-14). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-118271 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-118271?

Check whether you run A2ui-Project A2ui at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118271: a2ui data-context Resolver resource exhaustion

CVE-2026-118271 · Severity: medium · CVSS 4.3 · Published 2026-10-28

a2ui is a web UI framework that processes function calls with reactive data binding. An attacker can send function calls with thousands of junk arguments, causing the data-context resolver to consume excessive memory and slow down the application, potentially causing denial of service.

Technologies: A2ui-Project A2ui. Vendors: A2ui-Project.

Quick answers

Is CVE-2026-118271 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118271 being exploited in the wild.
How severe is CVE-2026-118271?: Medium severity, with a CVSS score of 4.3, published 28 October 2026.
Which products and versions are affected?: A2ui-Project A2ui up to 0.10.6.
Is there a fix for CVE-2026-118271?: Yes: fixed in Commit eb314e14fabd29cfb4a74e1202afc4fe2081efa2 (2026-09-14). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118271 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-118271?: Check whether you run A2ui-Project A2ui at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Commit eb314e14fabd29cfb4a74e1202afc4fe2081efa2 (2026-09-14)

Technical details

The vulnerability exists in the DataContext resolver component (renderers/web_core/src/v0_9/rendering/data-context.ts), where function argument validation occurs after memory listeners are created for all supplied arguments. An attacker can send crafted messages with hundreds or thousands of unused arguments, forcing the resolver to allocate listeners for each junk key before discarding them. The fix strips unused arguments before listener creation and enforces a 255-argument maximum per function call.

Affected products

a2ui-project a2ui up to 0.10.6

Timeline

2026-10-28: disclosed: Public disclosure via NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.