| 제목 | zhayujie CowAgent 2.1.6 Denial of Service |
|---|
| 설명 | CowAgent has a high-impact denial of service vulnerability in the Web Console /message endpoint.
The endpoint reads and parses the full request body before any size check. Each accepted message also allocates request mappings, SSE stream state, an unbounded session Queue(), and starts a raw thread.
An attacker who can access the Web Console can send oversized bodies or many messages with unique session_id values to rapidly consume memory, create excessive threads, grow unbounded queues/SSE state, and make the CowAgent service unavailable. If the messages reach the Agent workflow, the attack can also amplify paid model/API usage.
Verified on CowAgent commit 61206ba73479db054921594a57b7df1c82694d29 / Desktop version 2.1.6. |
|---|
| 원천 | ⚠️ https://github.com/hackerguopeng/cve/tree/main/CowAgent_Web_Message_Queue_Thread_SSE_DoS_Report |
|---|
| 사용자 | hackerguopeng (UID 99623) |
|---|
| 제출 | 2026. 09. 03. AM 10:18 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 10. 10. PM 11:22 (1 month later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 416389 [zhayujie CowAgent 까지 2.1.7 Web Console web_channel.py session_id 서비스 거부] |
|---|
| 포인트들 | 20 |
|---|