CVE-2026-108768: Allocation of Resources in zhayujie CowAgent

This vulnerability affects the json.loads function within the Streaming Tool-Call Argument Handler component of zhayujie CowAgent versions 2.0, 2.1, and 2.2.0. The issue allows an attacker to manipulate input to cause allocation of resources, potentially leading to resource exhaustion or denial of service. The attack can be initiated remotely with low complexity and no privileges or user interaction required. The vendor has been contacted but has not provided any response or fix. Public exploit code is available, indicating potential for exploitation, though no active exploitation in the wild has been reported.

The vulnerability allows remote attackers to cause allocation of resources via crafted input to json.loads, which may lead to resource exhaustion or denial of service conditions. The CVSS 4.0 score of 5.3 reflects a medium severity impact with no confidentiality, integrity, or availability impact beyond resource allocation. No evidence of active exploitation in the wild has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing network-level protections such as input validation or limiting access to the affected component until a patch is released.