# CVE-2026-120237: CVE-2026-120237

Status: published. Published: 2026-11-01. Updated: 2026-11-01.

A flaw has been found in ag-ui-protocol ag-ui up to 0.0.58. Affected by this issue is the function isInterruptExpired of the file sdks/typescript/packages/client/src/interrupts/index.ts of the component Interrupt expiry. This manipulation causes resource consumption. Remote exploitation of the attack is possible. The exploit has been published and may be used. The pull request to fix this issue awaits acceptance.

## Remediation

No remediation reported in collected sources

## Affected products and versions

Not reported in collected sources.

## Severity and prioritization

- CVSS 4.0: 2.1 (low); CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X; source: NVD: cna@vuldb.com

- CVSS 3.1: 4.3 (medium); CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L; source: NVD: cna@vuldb.com

- CVSS 2.0: 4 (medium); AV:N/AC:L/Au:S/C:N/I:N/A:P; source: NVD: cna@vuldb.com

- CISA KEV: No listing in collected sources

- EPSS: Not available

- SSVC: Not available

- Weaknesses: CWE-400

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://github.com/ag-ui-protocol/ag-ui/ (cna@vuldb.com)

- https://github.com/ag-ui-protocol/ag-ui/issues/2525 (cna@vuldb.com)

- https://github.com/ag-ui-protocol/ag-ui/pull/3241 (cna@vuldb.com)

- https://vuldb.com/cve/CVE-2026-120237 (cna@vuldb.com)

- https://vuldb.com/submit/1015179 (cna@vuldb.com)

- https://vuldb.com/vuln/429596 (cna@vuldb.com)

- https://vuldb.com/vuln/429596/cti (cna@vuldb.com)

## Provenance

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-120237; retrieved 2026-11-02; source updated 2026-11-01

Revision: 2eef62dd84c7201d9ddb47ba1e513c85cbe9b92e666b5ee135375886858a1c3f

Canonical: https://y2.dev/cve/CVE-2026-120237