CVE-2026-108681 Details

A denial-of-service vulnerability has been identified in zhayujie CowAgent versions through 2.1.7. The issue resides in an unknown function within the file channel/web/web_channel.py, part of the Web Console component. The vulnerability arises from the handling of the session_id argument, which can be manipulated to cause a denial-of-service condition. This issue can be exploited remotely. Although version 2.1.7 (commit dec28324) introduces a 512MB body cap, it does not fully address the underlying problem.

To address this vulnerability, it is recommended to implement several measures: Enforce a request body limit before parsing JSON data, validate the parsed JSON against explicit limits, replace per-request raw threads with a bounded executor, and limit active SSE streams both globally and per session. Additionally, cleaning up request-to-session and request-to-agent mappings on error paths can help mitigate the impact.