CVE-2026-108683 Details
Description
A security vulnerability has been detected in zhayujie CowAgent up to 2.1.9. The impacted element is an unknown function of the component Media Download Handler. Such manipulation leads to uncontrolled memory allocation. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.2.0 is sufficient to resolve this issue. The name of the patch is b7967210268fc4c0afea1078223e74e7e96a8a54. You should upgrade the affected component.
A denial-of-service vulnerability has been identified in zhayujie CowAgent versions through 2.1.9. The issue arises in the Media Download Handler component, where an unknown function allows for uncontrolled memory allocation. This vulnerability can be exploited remotely, leading to excessive consumption of memory, disk space, and processing time, which can degrade the responsiveness of the application or cause it to become unavailable. The problem is particularly pronounced in channels like Feishu, DingTalk, QQ, Slack, and WeCom, where media downloads can be initiated by user actions.
Users can upgrade to CowAgent version 2.2.0, which addresses this vulnerability by implementing proper download limits and request timeouts. The update is available on the CowAgent GitHub Releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 11, 2026CISA-ADP
Assessed Oct 13, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/lche511/cve/tree/main/CowAgent_Channel_Media_Download_DoS_Report | [email protected] | ExploitTechnical Analysis |
| https://github.com/zhayujie/CowAgent/ | [email protected] | ProductSource CodeVendor |
| https://github.com/zhayujie/CowAgent/commit/b7967210268fc4c0afea1078223e74e7e96a8a54 | [email protected] | Source CodeVendor |
| https://github.com/zhayujie/CowAgent/releases/tag/2.2.0 | [email protected] | Release NotesVendor |
| https://vuldb.com/cve/CVE-2026-108683 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/submit/958015 | [email protected] | Issue TrackingPermission Required |
| https://vuldb.com/vuln/416391 | [email protected] | AdvisoryPermission Required |
| https://vuldb.com/vuln/416391/cti | [email protected] | AdvisoryPermission Required |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-789 | Memory Allocation with Excessive Size Value | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| zhayujie CowAgent | <= 2.1.9 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 13, 2026 | CVE Modified | CISA-ADP |
| Oct 11, 2026 | New CVE Received | [email protected] |