Executive brief
AG-UI is a protocol and library used to integrate AI agents into frontend applications. The SSE (Server-Sent Events) frame parser in the Rust SDK has an unbounded buffering vulnerability that allows a remote server to cause memory exhaustion by sending oversized frames or using CRLF line terminators per the SSE specification, leading to denial of service.
Technical details
The vulnerability exists in crates/ag-ui-client/src/sse.rs, where the SSE frame parser implements unbounded buffering without per-frame or total-size limits (CWE-400). The parser only recognizes LF-style line termination and fails to handle CRLF or lone CR characters as line endings, which are permitted by the SSE specification. When a remote endpoint sends frames with CRLF terminators or oversized payloads, the parser accumulates bytes indefinitely in its buffer, exhausting available memory. The attack requires only network connectivity to a server controlled by the attacker or a compromised endpoint; no authentication or user interaction is needed. A fix is pending acceptance in a pull request.
Affected products
- ag-ui-protocol ag-ui 1.0
Timeline
- 2026-09-16: disclosed
- other: Issue reported 2026-08-18