CVE-2026-92361CWE-400CWE-404denial-of-service

CVE-2026-92361

Medium · published September 16, 2026

CVSS v3.1
4.3
EPSS
1%
Percentile
44.2
In the wild
Unconfirmed
What it is

A security vulnerability has been detected in ag-ui-protocol ag-ui 1.0. This affects an unknown function of the file sdks/community/go/pkg/client/sse/client.go of the component SSE Client. Such manipulation leads to resource consumption. The attack can be executed remotely. The pull request to fix this issue awaits acceptance.

The record
Technical detail
CVSS v3.1
4.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
5.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X
EPSS
0.00533 · 44.2th percentile
Weaknesses
CWE-400 · Uncontrolled Resource Consumption; CWE-404 · Improper Resource Shutdown or Release
Published
2026-09-16T17:18Z
References (7)
https://github.com/ag-ui-protocol/ag-ui/ · [email protected]https://github.com/ag-ui-protocol/ag-ui/issues/2438 · [email protected]https://github.com/ag-ui-protocol/ag-ui/pull/2700 · [email protected]https://vuldb.com/cve/CVE-2026-92361 · [email protected]https://vuldb.com/submit/934952 · [email protected]https://vuldb.com/vuln/405447 · [email protected]https://vuldb.com/vuln/405447/cti · [email protected]
EPSS history
Timeline
  • 18 SEP 04:02Z
    EPSS moved — → 1%
    epss
  • 16 SEP 13:00Z
    ag-ui-protocol ag-ui SSE Client client.go resource consumption
    cvelistv5