Executive brief
AG-UI is a framework for integrating AI agents into frontend applications. The Go community SDK's SSE (Server-Sent Events) client component fails to limit memory consumption when processing event streams, allowing a malicious agent endpoint to exhaust client memory and cause service denial without authentication or user interaction.
Technical details
The vulnerability is an uncontrolled resource consumption flaw (CWE-400) in the SSE Client component (sdks/community/go/pkg/client/sse/client.go, lines 191–303). The SSE client appends incoming event data, event lines, and id lines without enforcing per-item or total-size limits, causing unbounded memory growth during a single stream connection. An attacker controlling a malicious or compromised agent endpoint can trigger memory exhaustion on any client connecting to it via SSE. The attack requires network reachability to the agent endpoint but no authentication. A fix awaits acceptance in a pending pull request; remediation options include implementing per-event size caps, per-id length caps, and total stream budgets as used in the reference Dart SDK implementation.
Affected products
- AG-UI Protocol ag-ui 1.0
Timeline
- 2026-08-18: disclosed: Issue reported on GitHub
- 2026-09-16: advisory: CVE-2026-92361 published
- 2026-09-16: other: Patch pending acceptance