CVE-2026-108681: Denial of Service in zhayujie CowAgent

This vulnerability in zhayujie CowAgent up to version 2.1.7 involves improper handling of the session_id argument in the Web Console's web_channel.py file, leading to a denial of service condition. An attacker can exploit this remotely to disrupt service availability. Although version 2.1.7 introduces a partial mitigation by capping the request body size at 512MB, this does not fully resolve the issue. The vendor has been contacted and a patch is available, but no explicit patch link is provided in the data. The vulnerability has been publicly disclosed and exploit code is available.

Successful exploitation results in denial of service, causing the affected CowAgent service to become unavailable. This can disrupt operations relying on the Web Console component. The impact is limited to availability and does not include privilege escalation or data confidentiality breaches according to the provided data.

A patch is available for this vulnerability. Version 2.1.7 includes a partial mitigation by limiting the request body size to 512MB, but users should apply the official patch or update beyond 2.1.7 once available to fully remediate the issue. Since this is a cloud service, the vendor manages remediation for hosted instances; users should consult the vendor advisory for current patch status and guidance.