| عنوان | zhayujie CowAgent 2.1.6 Denial of Service |
|---|
| الوصف | CowAgent has a high-impact denial of service vulnerability in the Web Console /upload endpoint.
The general upload path reads uploaded files completely into memory with unbounded read() calls before writing them to disk. It does not enforce a single-file size limit, directory file-count limit, or total upload-size limit.
An attacker who can access the Web Console can upload oversized files or directories with many files to rapidly consume process memory, fill disk storage, create excessive filesystem work, degrade service responsiveness, and potentially make CowAgent unavailable. Uploaded files may also amplify later Agent parsing and model/API cost.
Verified on CowAgent commit 61206ba73479db054921594a57b7df1c82694d29 / Desktop version 2.1.6. A safe PoC showed a 12 MiB file and a 120-file directory were accepted, with file reads performed through unbounded read() calls. |
|---|
| المصدر | ⚠️ https://github.com/hackerguopeng/cve/tree/main/CowAgent_Web_Upload_File_Directory_DoS_Report |
|---|
| المستخدم | hackerguopeng (UID 99623) |
|---|
| ارسال | 03/09/2026 11:25 AM (2 أشهر منذ) |
|---|
| الاعتدال | 10/10/2026 11:22 PM (1 month later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 416390 [zhayujie CowAgent حتى 2.1.6 Web Console /upload read الحرمان من الخدمة] |
|---|
| النقاط | 20 |
|---|