Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.1
CVE-2026-108768: CowAgent allows remote resource exhaustion via JSON input
CVE-2026-108768 · published 7 days ago
Summary
The CowAgent software (versions up to 2.2.0) can be triggered from a distance to consume excessive system resources when it processes specially crafted JSON data in its streaming tool-call handler. This can slow down or crash the application, affecting availability. Apply the vendor's update or patch the affected function to validate and limit incoming JSON data.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| zhayujie | cowagent | 2.0 |
Original advisory text
zhayujie CowAgent Streaming Tool-Call Argument json.loads allocation of resources
A vulnerability was identified in zhayujie CowAgent up to 2.2.0. Affected by this issue is the function json.loads of the component Streaming Tool-Call Argument Handler. The manipulation leads to allocation of resources. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.
Internet-facing
60 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker partial control
Type
CWE-400Uncontrolled Resource Consumption
CWE-770Allocation of Resources Without Limits
Timeline
Published11 Oct 2026
Updated15 Oct 2026
First seen11 Oct 2026
Track software like this
Free during beta