This vulnerability affects ag-ui-protocol ag-ui version 1.0 and is located in the SSE Frame Parser component within the file crates/ag-ui-client/src/sse.rs. An attacker can remotely manipulate an unknown function to cause resource consumption, potentially leading to denial of service or degraded performance. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity. The attack vector is network-based with low complexity and no privileges or user interaction required. The vendor has a pull request with a fix awaiting acceptance, indicating no official patch is yet released.

The vulnerability allows remote attackers to cause resource consumption on the affected system, which may lead to denial of service or performance degradation. There is no indication of privilege escalation, data disclosure, or code execution from the provided information.

A fix for this vulnerability exists in a pull request but is not yet officially accepted or released. Until the fix is integrated and deployed, users should monitor vendor advisories for patch availability. No other vendor-provided mitigation or workaround is currently documented.