CVE-2026-108681: zhayujie CowAgent Web Console web_channel.py denial of service
A security flaw has been discovered in zhayujie CowAgent up to 2.1.7. Impacted is an unknown function of the file channel/web/webchannel.py of the component Web Console. The manipulation of the argument sessionid results in denial of service. The attack may be performed from remote. The exploit has been released to the public and may be used for attacks. Version 2.1.7 (commit dec28324) only partly mitigates via a 512MB body cap. The vendor was contacted early about this disclosure.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Configure a 512MB request body cap as the partial mitigation described for version 2.1.7.
CowAgent Web Console request body cap = 512MB
Event History
Frequently Asked Questions
Who can exploit this issue?
A remote attacker with low-privilege access can exploit the Web Console by manipulating the session_id argument. No user interaction is required.
Does upgrading to version 2.1.7 fully resolve the denial-of-service risk?
No. Version 2.1.7, commit dec28324, only partially mitigates the issue by imposing a 512MB request-body cap.
How likely is exploitation?
Public exploit code has been released, so the issue may be used in attacks. The supplied assessment rates exploit maturity as proof-of-concept.