EUVD-2026-97122
GHSA-cmfc-4qwc-4894
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate with low-privilege access to CowAgent
-
ExploitSend crafted streaming tool-call arguments
-
Executionjson.loads triggers uncontrolled resource allocation
-
ImpactService availability degraded (DoS)
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires low-privilege authenticated access to a CowAgent instance (version 2.2.0 or earlier) whose Streaming Tool-Call Argument Handler feeds attacker-influenced tool-call arguments into json.loads. The attacker must be able to supply or influence the streaming tool-call argument stream (e.g., via the agent's tool-calling interface). Limiting factors: per the CVSS 4.0 vector, authentication is required (PR:L) and impact is confined to limited availability (VA:L) with no confidentiality or integrity effect; the affected product is a niche open-source project with minimal deployment, further constraining real-world exposure. |
| Impact | This is a low-priority issue despite being remotely reachable. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores only 2.1, driven entirely by a limited availability impact (VA:L) with no confidentiality or integrity impact (VC:N/VI:N) - consistent with a CWE-770 uncontrolled resource allocation (denial of service) rather than code execution or data exposure. Public exploit code exists (VulDB-linked GitHub PoC), which raises the practical likelihood of opportunistic abuse, but there is no CISA KEV listing and no EPSS score provided, so there is no evidence of active or widespread exploitation. The PR:L metric indicates exploitation requires at least low-privilege authenticated access, meaningfully narrowing the attacker population. Net: a genuine but minor availability bug - worth patching in affected deployments, but not an emergency relative to higher-impact CVEs. Note: no independent vendor advisory exists because the vendor did not respond to disclosure, so affected-version and fix data rest on VulDB's single-source report. |
| Exploit ScenarioDerived | A low-privileged but authenticated user (or an integrated LLM/tool-call client) submits crafted or malformed streaming tool-call arguments that CowAgent passes to json.loads in its Streaming Tool-Call Argument Handler, triggering excessive resource allocation. Repeated requests degrade or exhaust availability of the agent service. A public proof-of-concept for this JSON-repair DoS is available on GitHub, lowering the effort to reproduce. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 11, 2026
Denial of service in zhayujie CowAgent through 2.2.0 lets a low-privilege authenticated remote attacker exhaust process resources by supplying attacker-influenced streaming tool-call arguments that are passed unbounded to json.loads inside the agent's Streaming Tool-Call Argument Handler. The issue is rated CVSS 2.1 / CVSS:4.0 (AV:N/AC:L/PR:L/UI:N/VA:L, E:P), so impact is confined to limited availability with no confidentiality or integrity effect, and the affected project is a niche open-source LLM agent framework with limited deployment. Publicly available exploit code exists (a proof-of-concept report is published on GitHub), but there is no confirmed active exploitation (CISA KEV); the vendor was contacted and did not respond, so no patched release has been confirmed.
RemediationAI
No vendor-released patch identified at time of analysis: the maintainer was contacted about this disclosure and did not respond, and the wildcard CPE entry implies no fixed version has been published for releases up to 2.2.0, so remediation must currently rely on compensating controls. Restrict network exposure of the CowAgent tool-call and streaming endpoints to trusted clients or a reverse proxy that enforces authentication, and apply per-principal rate limits and concurrency caps on streaming sessions, accepting reduced throughput for legitimate heavy users. Enforce a hard maximum on streamed tool-call argument size and on the number of repair/parse iterations before json.loads is invoked, rejecting oversized or malformed payloads early; the trade-off is that legitimate large tool arguments such as embedded code, files, or long structured data may be truncated or rejected and will need a raised, explicitly configured limit. Run the agent under memory and CPU cgroup quotas with per-request timeouts so that resource exhaustion from unbounded parsing terminates the offending worker instead of the host, noting that aggressive limits can kill long-running but legitimate agent sessions. Finally, monitor for memory growth and JSON-parsing CPU spikes correlated with a single authenticated user or tool-call stream, and apply those signals as alerts until an upstream fix from https://github.com/zhayujie/CowAgent becomes available.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
CowAgent is an open-source LLM agent framework (zhayujie) whose streaming tool-call pipeline incrementally assembles and repairs JSON argument fragments emitted by a model or client, ultimately handing them to Python's json.loads. The weakness is CWE-770 (Allocation of Resources Without Limits or Throttling): the handler performs no cap on the size or count of streamed tool-call argument chunks and no throttling of parse attempts, so an attacker who can inject or influence the argument stream can force repeated large allocations and CPU-bound JSON parsing, driving memory or CPU exhaustion and degraded availability. The wildcard CPE cpe:2.3:a:zhayujie:cowagent:*:*:*:*:*:*:*:* reflects that no fixed version is defined for any release up to and including 2.2.0. The CVSS 4.0 vector (PR:L) and the independent assessment (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L) agree that exploitation requires an authenticated low-privilege session that can reach the tool-calling interface, that the attack is network-reachable, and that the resulting impact is a limited availability loss rather than code execution or data disclosure.
Know when Cowagent gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
Network-reachable (AV:N) and easy (AC:L) but requires low-privilege authenticated access (PR:L); only partial availability impact from resource exhaustion, with no confidentiality or integrity effect.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
3DescriptionCVE.org
A vulnerability was identified in zhayujie CowAgent up to 2.2.0. Affected by this issue is the function json.loads of the component Streaming Tool-Call Argument Handler. The manipulation leads to allocation of resources. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Denial of service in zhayujie CowAgent through version 2.2.0 allows an authenticated, low-privileged user to disrupt the
Denial of service in zhayujie CowAgent (up to and including 2.1.7) allows an authenticated remote user with low privileg
Denial of service in zhayujie CowAgent 2.1.6 and earlier allows an authenticated remote attacker with a low-privilege se
Server-side request forgery in zhayujie CowAgent up to version 2.1.1 allows low-privileged authenticated users to direct
Unbounded memory allocation in the media download handler of zhayujie CowAgent through version 2.1.9 allows an authentic
Denial of service in zhayujie CowAgent up to version 2.1.7 allows a low-privileged remote attacker to crash or degrade a
Information disclosure in zhayujie CowAgent up to version 2.1.0 exposes sensitive data to low-privileged authenticated r
Incorrect authorization in zhayujie CowAgent up to version 2.1.1 allows low-privilege authenticated remote attackers to
Denial of service in zhayujie CowAgent up to version 2.1.3 allows a low-privileged remote attacker to crash or hang the
Exploit-DB