Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-108681— zhayujie CowAgent Web Console web_channel.py denial of service

Quick assessment

Affected
zhayujie CowAgent
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 zhayujie CowAgent（2.1.7 及更早版本）中发现了一个安全漏洞。该漏洞影响组件“Web 控制台”中的 文件的一个未知函数。由于对参数 的恶意操纵，可导致拒绝服务（DoS）。攻击者可以从远程发起攻击。目前该漏洞的利用代码已公开，可能被用于实际攻击。 尽管供应商在漏洞披露前已提前获悉相关情况，但版本 2.1.7（提交哈希 dec28324）仅通过设置 512MB 的请求体大小限制部分缓解了该问题，并未彻底修复漏洞。

CVSS 4.3 · Medium EPSS 0.45% · P37

Affected Version Matrix 8

VendorProduct Version RangeStatus
zhayujie CowAgent 2.1.0 affected
2.1.1 affected
2.1.2 affected
2.1.3 affected
2.1.4 affected
2.1.5 affected
2.1.6 affected
2.1.7 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-108681

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
zhayujie CowAgent Web Console web_channel.py denial of service
Source: CVE Program / CVE List V5
Vulnerability Description
A security flaw has been discovered in zhayujie CowAgent up to 2.1.7. Impacted is an unknown function of the file channel/web/web_channel.py of the component Web Console. The manipulation of the argument session_id results in denial of service. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. Version 2.1.7 (commit dec28324) only partly mitigates via a 512MB body cap. The vendor was contacted early about this disclosure.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
不恰当的资源关闭或释放
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
zhayujie CowAgent 2.1.0 cpe:2.3:a:zhayujie:cowagent:*:*:*:*:*:*:*:*

II. Public POCs for CVE-2026-108681

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-108681

请登录查看更多情报信息。

Proof of Concept for CVE-2026-108681 (1)

Same Patch Batch · zhayujie · 2026-10-11 · 5 CVEs total

CVE-2026-108682 5.4 MEDIUM zhayujie CowAgent Web Console upload read denial of service
CVE-2026-108683 4.3 MEDIUM zhayujie CowAgent Media Download memory allocation
CVE-2026-108768 4.3 MEDIUM zhayujie CowAgent Streaming Tool-Call Argument json.loads allocation of resources
CVE-2026-108769 4.3 MEDIUM zhayujie CowAgent Markdown Rendering Markdown.tsx denial of service

IV. Related Vulnerabilities

Same product: CowAgent
Same vendor: zhayujie
Same weakness: CWE-404

V. Comments for CVE-2026-108681

No comments yet

Leave a comment