Resource exhaustion in A2ui-Project A2ui
CVE-2026-118276
A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This vulnerability affects the function formatString of the file renderers/web_core/src/v0_9/basic_catalog/expressions/expression_parser.ts of the component Parser. This manipulation causes resource consumption. The attack may be initiated remotely. The exploit has been publicly disclosed and may be utilized. Patch name: 1f71d1aac1b145ef57c7526f9e0cff316f5934e2. Applying a patch is the recommended action to fix this issue.
Vulnerability class: DoS (Denial of Service)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 3.5 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L.
EPSS exploit prediction
EPSS: 0.002 (14.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 15th percentile — 14.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
The 30-day trend appears once there are two daily scores.
Affected products
- A2ui-Project A2ui — versions 0.10.0, 0.10.1, 0.10.2
Weakness classification (CWE)
References
- vuldb.com/vuln/427574 (technical-description, vdb-entry)
- vuldb.com/vuln/427574/cti (signature, permissions-required)
- vuldb.com/cve/CVE-2026-118276 (third-party-advisory)
- vuldb.com/submit/1015139 (third-party-advisory)
- github.com/a2ui-project/a2ui/issues/2389 (issue-tracking, exploit)
- github.com/a2ui-project/a2ui/pull/2433 (issue-tracking, patch)
- github.com/a2ui-project/a2ui/commit/1f71d1aac1b145ef57c7526f9e0cff316f5934e2 (patch)
- github.com/a2ui-project/a2ui/ (product)
Frequently asked questions
- What is CVE-2026-118276?
- CVE-2026-118276 is a low-severity vulnerability in A2ui-Project A2ui, classified under Uncontrolled Resource Consumption. CVSS score: 3.5/10. Published 2026-10-28.
- How severe is CVE-2026-118276?
- Low severity. CVSS v3 base score is 3.5 out of 10.