EUVD-2026-97039
GHSA-gvp9-cf4x-m67p
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAccess connected chat channel as participant
-
ExploitSend message with oversized media
-
ExecutionTrigger unbounded download allocation in handler
-
ImpactExhaust host memory (service DoS)
Vulnerability Assessment
| Weakness |
CWE
ASVS 5.0
V15 - Secure Coding and Architecture Memory allocation limits
|
| Exploitation Conditions | Requires a CowAgent instance at version 2.1.9 or earlier that is actively connected to a messaging platform (the patched code covers DingTalk and Feishu media channels) and the attacker must be able to deliver a media message/URL through that channel, i.e. be an authenticated participant (PR:L) - this is not anonymous internet-wide exploitation. The vulnerable Media Download Handler must process the attacker-influenced media without enforcing the size limit (MAX_FILE_BYTES) introduced in 2.2.0. Limiting factors that reduce real-world risk: impact is availability-only (temporary memory exhaustion/DoS, no RCE or data exposure), the attacker needs channel access rather than pure unauthenticated network reach, and hosts with constrained per-process memory or external request limits may blunt the effect. |
| Impact | This is a medium-severity denial-of-service issue, not a high-priority emergency. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 5.3 and shows the only impact is availability (VA:L), with no confidentiality or integrity impact (VC:N/VI:N) and no scope change - consistent with CWE-789 (uncontrolled memory allocation) causing memory exhaustion rather than code execution or data exposure. SSVC-relevant signals: exploitation maturity is Proof-of-Concept (E:P in the vector) and publicly available exploit code exists (a GitHub DoS report), but there is NO CISA KEV listing and NO active-exploitation evidence, so a PoC must not be read as in-the-wild use. No EPSS score was provided, so exploitation probability cannot be quantified from this data. The PR:L metric means exploitation requires some authenticated/participant access to a connected messaging channel, which further limits opportunistic mass exploitation. Net: a real but low-urgency bug - patch during normal maintenance; it does not warrant emergency response. Note one conflict to verify: the input Tag 'Information Disclosure' contradicts the vector and CWE, which describe a pure availability/memory-exhaustion flaw with no confidentiality impact. |
| Exploit ScenarioDerived | An attacker who can send messages through a chat channel (e.g. DingTalk or Feishu) connected to a CowAgent ≤2.1.9 instance posts a message referencing an oversized media file. The bot's Media Download Handler fetches the file without enforcing a size cap, allocating unbounded memory and exhausting the host, degrading or crashing the service. A public proof-of-concept DoS report exists for this exact path. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Unbounded memory allocation in the media download handler of zhayujie CowAgent through version 2.1.9 allows an authenticated participant in a connected messaging channel (the patched code covers DingTalk and Feishu media paths) to exhaust the agent's process memory by supplying oversized or unvalidated remote media, producing a denial-of-service condition with availability-only impact. Publicly available exploit code exists (a proof-of-concept report is published on GitHub), but there is no confirmation of active exploitation (not listed in CISA KEV), and the exposure is limited because the attacker must already be able to deliver a media message through the bot's channel rather than reaching it anonymously over the internet. The vendor resolved the issue by routing all channel downloads through a size-bounded helper in version 2.2.0.
RemediationAI
Upgrade to CowAgent 2.2.0, which is the vendor-released fix; the corrective change is commit b7967210268fc4c0afea1078223e74e7e96a8a54 and the tagged release is at https://github.com/zhayujie/CowAgent/releases/tag/2.2.0 (advisory: https://vuldb.com/vuln/416391). If immediate upgrade is not possible, the most direct compensating control is to stop the bot from accepting inbound media: disable or remove the DingTalk and Feishu media download paths (or drop image/file messages before they reach the handler) so user-supplied URLs and attachments are never fetched - the trade-off is loss of image and file relay functionality in those channels. Alternatively, restrict who can post to the bot by limiting channel membership or gateway permissions to trusted participants, since exploitation requires channel access rather than anonymous reach, and front the agent with an egress proxy that caps response body size and enforces short read timeouts so oversized or endless bodies are truncated or rejected before they reach the process (trade-off: legitimate large attachments above the proxy limit will fail). As a last-resort containment for hosts that must keep media enabled, cap the CowAgent process memory with cgroup/container limits so exhaustion results in a controlled restart rather than host-wide memory pressure - noting this trades availability of the single agent process for host stability. After applying any of these, monitor for repeated OOM kills or restarts in the agent container as evidence an exploit attempt is still being delivered, and block or mute the source channel account.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-789, uncontrolled memory allocation, in CowAgent's channel-specific media download routines. Before 2.2.0, channel/dingtalk/dingtalk_message.py and channel/feishu/feishu_channel.py each implemented their own download logic: DingTalk had a local _save_download with a MAX_INBOUND_MEDIA_BYTES cap and a Content-Length pre-check, while Feishu had _download_remote_bytes that accumulated chunks into an in-memory bytearray using its own MAX_REMOTE_IMAGE_BYTES/MAX_REMOTE_FILE_BYTES constants. These per-channel implementations guarded inconsistently - a missing, malformed or understated Content-Length header, or a response that never terminates, allowed a remote-controlled body to drive allocation without a hard central ceiling. The fix commit b7967210268fc4c0afea1078223e74e7e96a8a54 refactors both channels onto a shared common/media_download module exposing MAX_FILE_BYTES, MAX_IMAGE_BYTES, download_to_file() and download_bytes(), so every inbound media fetch is streamed through one enforced byte budget. The affected CPE is cpe:2.3:a:zhayujie:cowagent:*:*:*:*:*:*:*:*, i.e. the Python-based CowAgent (chatgpt-on-wechat lineage) package as distributed from the vendor GitHub repository; the CVSS 4.0 vector supplied by the source (AV:N/AC:L/PR:L/UI:N, VA:L, E:P) and the independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) agree that the consequence is limited to partial availability loss, with no confidentiality or integrity impact and no code execution path.
Know when Cowagent gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Remotely reachable via a connected channel (AV:N/AC:L) but needs participant access to send media (PR:L, no UI); memory exhaustion yields partial availability impact only (A:L) with no C/I impact.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A security vulnerability has been detected in zhayujie CowAgent up to 2.1.9. The impacted element is an unknown function of the component Media Download Handler. Such manipulation leads to uncontrolled memory allocation. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.2.0 is sufficient to resolve this issue. The name of the patch is b7967210268fc4c0afea1078223e74e7e96a8a54. You should upgrade the affected component.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Denial of service in zhayujie CowAgent through version 2.2.0 allows an authenticated, low-privileged user to disrupt the
Denial of service in zhayujie CowAgent through 2.2.0 lets a low-privilege authenticated remote attacker exhaust process
Denial of service in zhayujie CowAgent (up to and including 2.1.7) allows an authenticated remote user with low privileg
Denial of service in zhayujie CowAgent 2.1.6 and earlier allows an authenticated remote attacker with a low-privilege se
Server-side request forgery in zhayujie CowAgent up to version 2.1.1 allows low-privileged authenticated users to direct
Denial of service in zhayujie CowAgent up to version 2.1.7 allows a low-privileged remote attacker to crash or degrade a
Information disclosure in zhayujie CowAgent up to version 2.1.0 exposes sensitive data to low-privileged authenticated r
Incorrect authorization in zhayujie CowAgent up to version 2.1.1 allows low-privilege authenticated remote attackers to
Denial of service in zhayujie CowAgent up to version 2.1.3 allows a low-privileged remote attacker to crash or hang the
Exploit-DB