# CVE-2026-118274: a2ui generic-binder resource consumption via unbounded child list

Source: https://junglewise.ai/threats/cve-2026-118274-a-vulnerability-has-been-found-in-a2ui-project-a2ui-up-to-0-10-6  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-118274 · Severity: medium · CVSS 4.3 · Published 2026-10-28

a2ui is a JavaScript UI framework component library. When displaying dynamic lists of child components bound to large data arrays (100,000+ items), the framework fails to limit object creation, causing uncontrolled memory consumption and UI thread lockup. This can be exploited remotely to freeze or crash applications using the framework.

Technologies: [A2ui-Project A2ui](https://junglewise.ai/threats/technologies/a2ui-project-a2ui). Vendors: [A2ui-Project](https://junglewise.ai/threats/vendors/a2ui-project).

## Quick answers

**Is CVE-2026-118274 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118274 being exploited in the wild.

**How severe is CVE-2026-118274?** Medium severity, with a CVSS score of 4.3, published 28 October 2026.

**Which products and versions are affected?** A2ui-Project A2ui up to 0.10.6.

**Is there a fix for CVE-2026-118274?** Yes: fixed in a2ui 0.10.7 or later (patch c97f4a02d3fea33ce3e9de5cf3fd0e3b8f3a4f0e caps MAX_DYNAMIC_CHILD_LIST_SIZE to 1000). Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-118274 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-118274?** Check whether you run A2ui-Project A2ui at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in a2ui 0.10.7 or later (patch c97f4a02d3fea33ce3e9de5cf3fd0e3b8f3a4f0e caps MAX_DYNAMIC_CHILD_LIST_SIZE to 1000)

## Technical details

CWE-400 uncontrolled resource consumption in GenericBinder's dynamic ChildList mapping: when a container component binds to large data-model arrays via dynamic templates, the binder generates unbounded child component descriptors and performs deep cloning on every state update without limits. An attacker can trigger this by sending data payloads with 100,000+ array items to a vulnerable application, exhausting client heap memory and locking the UI thread.

## Affected products

- a2ui-project a2ui up to 0.10.6

## Timeline

- 2026-09-14: other: Patch commit dated 2026-09-14T23:16:43+05:30
- 2026-10-28: disclosed
- 2026-10-28: advisory: CVE-2026-118274 published

## References

- [https://github.com/a2ui-project/a2ui/](https://github.com/a2ui-project/a2ui/)
- [https://github.com/a2ui-project/a2ui/commit/c97f4a02d3fea33ce3e9de5cf3fd0e3b8f3a4f0e](https://github.com/a2ui-project/a2ui/commit/c97f4a02d3fea33ce3e9de5cf3fd0e3b8f3a4f0e)

## Related threats

- [a2ui legacy Lit renderer uncontrolled property injection](https://junglewise.ai/threats/cve-2026-118538-a-vulnerability-was-determined-in-a2ui-project-a2ui-up-to-0-12-0)
- [a2ui improper input validation in media components URL](https://junglewise.ai/threats/cve-2026-118537-a-vulnerability-was-found-in-a2ui-up-to-0-10-4-this)
- [a2ui uncontrolled recursion in DynamicValue resolver](https://junglewise.ai/threats/cve-2026-118275-a-vulnerability-was-found-in-a2ui-project-a2ui-up-to-0-10-6-this)
- [a2ui DataModel.set resource consumption via unbounded array indices](https://junglewise.ai/threats/cve-2026-118273-a-flaw-has-been-found-in-a2ui-project-a2ui-up-to-0-10-6-affected)
- [a2ui information exposure through error messages](https://junglewise.ai/threats/cve-2026-118272-a-vulnerability-was-detected-in-a2ui-project-a2ui-up-to-0-10-6)