EUVD-2026-96996
GHSA-9wr9-h75r-7xj4
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Web Console
-
ExploitSend crafted session_id to web_channel.py
-
ExecutionTrigger resource exhaustion (CWE-404)
-
ImpactService denial of availability
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Resource release
|
| Exploitation Conditions | Exploitation requires authenticated access (CVSS PR:L) to the CowAgent Web Console component, specifically the session_id argument handled in channel/web/web_channel.py. The attacker must be able to reach the Web Console over the network and submit requests through it. Limiting factors: at least low-level privileges are required (not unauthenticated), impact is restricted to availability with no data exposure, and version 2.1.7 (commit dec28324) partially mitigates via a 512MB request-body cap - so fully-updated instances raise the bar for the resource-exhaustion path, though the underlying improper-resource-release flaw is not fully resolved. |
| Impact | This is a moderate-severity, low-priority denial-of-service issue rather than a critical threat. The CVSS 4.0 vector (AV:N/AC:L/PR:L/UI:N) indicates network-reachable, low-complexity exploitation, but PR:L means the attacker must hold at least low-level privileges, and the impact is confined to availability only (VC:N/VI:N/VA:L) - no confidentiality or integrity loss and no scope change. The E:P exploit-maturity flag aligns with the input signal that proof-of-concept code is publicly available, but this is NOT the same as active exploitation: the CVE is not listed in CISA KEV, so exploitation status is 'publicly available exploit code exists,' not confirmed in-the-wild use. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The signals are internally consistent (low-impact DoS, authenticated, PoC exists, no KEV), pointing to a genuine but low-urgency bug. Note also that vendor remediation is only partial: version 2.1.7 (commit dec28324) merely adds a 512MB body cap rather than fully resolving the resource-exhaustion root cause (CWE-404), so even patched deployments may remain partially exposed. |
| Exploit ScenarioDerived | An authenticated user with access to the CowAgent Web Console sends crafted input via the session_id argument to channel/web/web_channel.py, exhausting server resources (per CWE-404, improper resource release) and rendering the service unavailable to other users. Public proof-of-concept code exists (hosted on GitHub), lowering the effort required to reproduce the attack. Because exploitation requires network reach plus low-level privileges and only affects availability, the practical blast radius is a single service outage rather than data compromise. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Denial of service in zhayujie CowAgent (up to and including 2.1.7) allows an authenticated remote user with low privileges to tie up server resources through the Web Console by manipulating the session_id argument processed in channel/web/web_channel.py. The flaw is an improper resource shutdown/release condition (CWE-404) that degrades availability only - there is no data exposure or integrity impact, and reachability requires network access to the Web Console plus a valid low-privileged session. Publicly available exploit code exists (an exploit report is linked from the CVE references) and the vendor was notified early, but there is no confirmed active exploitation (not in CISA KEV); version 2.1.7 commit dec28324 only partly mitigates the issue via a 512MB request-body cap.
RemediationAI
No vendor-released patch providing a complete fix was identified at time of analysis; the only vendor-side change referenced is the partial mitigation in version 2.1.7 (commit dec28324), which imposes a 512MB request-body cap on the Web Console but does not eliminate the improper resource release, so upgrading to 2.1.7 reduces one abuse path without closing the issue. Until a full fix ships, apply compensating controls: do not expose the CowAgent Web Console to untrusted networks - bind it to localhost or place it behind a reverse proxy/allow-list that requires authentication to reach (trade-off: blocks legitimate remote users); enforce per-account and per-source-IP concurrency and rate limits on Web Console sessions and SSE connections, and cap total simultaneous SSE streams at the proxy (trade-off: heavy legitimate users may be throttled or disconnected); restrict the Web Console to high-trust accounts only, since the assessed vector requires at least low privileges (trade-off: reduces the usable audience of the console); and monitor and auto-restart the application workers when thread/session counts or memory grow anomalously (trade-off: restarts briefly interrupt active sessions and only contain, not prevent, the DoS). Consult the VulDB record and advisory pages at https://vuldb.com/vuln/416389 and https://vuldb.com/cve/CVE-2026-108681 for current vendor guidance, and treat the linked public exploit material (https://github.com/hackerguopeng/cve/tree/main/CowAgent_Web_Message_Queue_Thread_SSE_DoS_Report) as a signal that exploitation is easy to replicate once console access is obtained.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is the CowAgent Web Console, specifically the web channel handler in channel/web/web_channel.py, which services browser-facing sessions and streams responses (the published exploit report is titled around a Web Message Queue Thread SSE DoS, indicating the Server-Sent Events path and its associated worker/message-queue threads). The root cause class is CWE-404, Improper Resource Shutdown or Release: attacker-controlled input in the session_id argument causes session-scoped resources - threads, queue entries, or open SSE connections - to be created without being correctly released, letting an attacker accumulate them until the service is exhausted. Because the vulnerability is availability-only (CVSS:4.0 .../VC:N/VI:N/VA:L, and the independently assessed CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L), the security consequence is resource depletion rather than code execution or data compromise. The CPE cpe:2.3:a:zhayujie:cowagent:*:*:*:*:*:*:*:* indicates all CowAgent releases are treated as affected by the record, with 2.1.7 (commit dec28324) adding only a 512MB request-body cap that limits one exhaustion vector but does not fully resolve the underlying resource-release defect.
Know when Cowagent gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Network-reachable Web Console with low-privilege authentication (PR:L) and low complexity; only availability is affected (A:L), with no confidentiality or integrity impact and no scope change.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security flaw has been discovered in zhayujie CowAgent up to 2.1.7. Impacted is an unknown function of the file channel/web/web_channel.py of the component Web Console. The manipulation of the argument session_id results in denial of service. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. Version 2.1.7 (commit dec28324) only partly mitigates via a 512MB body cap. The vendor was contacted early about this disclosure.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Denial of service in zhayujie CowAgent through version 2.2.0 allows an authenticated, low-privileged user to disrupt the
Denial of service in zhayujie CowAgent through 2.2.0 lets a low-privilege authenticated remote attacker exhaust process
Denial of service in zhayujie CowAgent 2.1.6 and earlier allows an authenticated remote attacker with a low-privilege se
Server-side request forgery in zhayujie CowAgent up to version 2.1.1 allows low-privileged authenticated users to direct
Unbounded memory allocation in the media download handler of zhayujie CowAgent through version 2.1.9 allows an authentic
Denial of service in zhayujie CowAgent up to version 2.1.7 allows a low-privileged remote attacker to crash or degrade a
Information disclosure in zhayujie CowAgent up to version 2.1.0 exposes sensitive data to low-privileged authenticated r
Incorrect authorization in zhayujie CowAgent up to version 2.1.1 allows low-privilege authenticated remote attackers to
Denial of service in zhayujie CowAgent up to version 2.1.3 allows a low-privileged remote attacker to crash or hang the
Exploit-DB