Description
A weakness has been identified in zhayujie CowAgent up to 2.1.6. The affected element is the function read of the file /upload of the component Web Console. This manipulation causes denial of service. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-10-11
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Assess Impact
AI Analysis

Impact

The vulnerability is a file‑upload flaw in the Web Console of CowAgent up to version 2.1.6. A crafted request to the /upload endpoint triggers an internal error in the read function, fully exhausting server resources and causing a denial of service. This flaw is classified as CWE‑404 and does not directly compromise confidentiality or integrity, but it can render the affected application unusable for legitimate users.

Affected Systems

CWE‑404 affects the zhayujie CowAgent product, specifically all releases up to and including 2.1.6. No later releases have been documented as impacted.

Risk and Exploitability

The CVSS score of 5.3 reflects a moderate severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that no large‑scale exploitation campaigns have been observed to date. However, the exploit is publicly available and can be executed remotely against any exposed CowAgent instance with the Web Console enabled, providing a straightforward path for attackers to interrupt services.

Generated by OpenCVE AI on October 11, 2026 at 15:39 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Check the vendor's website for a newer version or security patch for CowAgent; upgrade if a fix is released.
  • If an upgrade is not possible, disable the Web Console upload feature or set it to read‑only to eliminate the vulnerable endpoint.
  • Configure web server or application firewall rules to rate‑limit or block repeated upload attempts, reducing the likelihood of a successful denial of service attack.

Generated by OpenCVE AI on October 11, 2026 at 15:39 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 11 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in zhayujie CowAgent up to 2.1.6. The affected element is the function read of the file /upload of the component Web Console. This manipulation causes denial of service. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title zhayujie CowAgent Web Console upload read denial of service
First Time appeared Zhayujie
Zhayujie cowagent
Weaknesses CWE-404
CPEs cpe:2.3:a:zhayujie:cowagent:*:*:*:*:*:*:*:*
Vendors & Products Zhayujie
Zhayujie cowagent
References
Metrics cvssV2_0

{'score': 5.5, 'vector': 'AV:N/AC:L/Au:S/C:N/I:P/A:P/E:POC/RL:ND/RC:C'}

cvssV3_0

{'score': 5.4, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C'}

cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L/E:P/RL:X/RC:C'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Zhayujie Cowagent
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-10-14T16:52:57.819Z

Reserved: 2026-10-10T21:22:14.484Z

Link: CVE-2026-108682

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2026-10-11T15:16:52.610

Modified: 2026-10-14T17:18:21.330

Link: CVE-2026-108682

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-11T17:45:07Z

Weaknesses
  • CWE-404

    Improper Resource Shutdown or Release