CowAgent Tool Resource Handling Flaws

Denial of service in zhayujie CowAgent up to version 2.1.3 allows a low-privileged remote attacker to crash or hang the agent service by sending a crafted input to the BrowserTool component in `agent/tools/browser/browser_tool.py`. The underlying cause (CWE-404) is improper resource shutdown or release - likely a browser subprocess or evaluation call that hangs indefinitely rather than timing out cleanly. A public proof-of-concept exists on GitHub; the vendor was unresponsive to disclosure, and no patch has been released.

Denial of service in zhayujie CowAgent up to version 2.1.7 allows a low-privileged remote attacker to crash or degrade availability by manipulating input to the Bash Tool component (agent/tools/bash/bash.py). The root cause is CWE-404 (Improper Resource Shutdown or Release), suggesting the Bash Tool fails to bound, drain, or release output buffers when executing shell commands - consistent with the public PoC title 'CowAgent_Bash_Output_Buffer_DoS_Report'. A proof-of-concept exploit is publicly available on GitHub, though no patch has been released and the vendor was unresponsive to disclosure.