CVE-2026-30350
Published: 27 April 2026
Summary
CVE-2026-30350 is a high-severity Uncontrolled Resource Consumption (CWE-400) vulnerability. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 4.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SC-5 (Denial-of-service Protection) and SC-6 (Resource Availability).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly implements denial-of-service protections at system entry points to block crafted POST requests causing resource exhaustion on the /store/items/search endpoint.
Protects resource availability by bounding resources allocated to requests and terminating processes that consume excessive resources, mitigating the uncontrolled consumption triggered by the CVE.
Validates information inputs to the vulnerable endpoint to reject crafted POST requests that could lead to resource exhaustion.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Remote unauthenticated DoS via crafted request to public server endpoint directly enables T1190 (exploit public-facing application) for impact and T1499.004 (application/system exploitation) via resource exhaustion (CWE-400).
NVD Description
An issue in the /store/items/search endpoint of Agent Protocol server commit e9a89f allows attackers to cause a Denial of Service (DoS) via a crafted POST request.
Deeper analysisAI
CVE-2026-30350 is a vulnerability in the Agent Protocol server at commit e9a89f, affecting the /store/items/search endpoint. The issue enables attackers to trigger a Denial of Service (DoS) condition by sending a crafted POST request. It is classified under CWE-400 (Uncontrolled Resource Consumption) and carries a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), indicating high severity primarily due to availability impact.
The vulnerability can be exploited remotely over the network by any unauthenticated attacker with low attack complexity and no need for user interaction. By crafting and submitting a malicious POST request to the vulnerable endpoint, the attacker can consume excessive resources on the server, leading to a DoS that disrupts service availability without affecting confidentiality or integrity.
Advisories and additional details are provided in the following references: https://gist.github.com/syphonetic/d27b5965c884555acea1827988689f7d and https://github.com/ibbybuilds/aegra/tree/main.
Details
- CWE(s)