| Title | zhayujie CowAgent 2.1.6 Denial of Service |
|---|
| Description | CowAgent has a medium-impact denial of service vulnerability in streaming tool-call argument handling.
When a model streams tool_calls[*].function.arguments, CowAgent appends every argument fragment into an in-memory string. Only after the full stream finishes does it call json.loads() and may fall back to json_repair. There is no hard size limit before accumulation, parsing, or JSON repair.
A malicious or compromised model provider, model gateway, OpenAI-compatible endpoint, or prompt-influenced model response can return oversized tool arguments. CowAgent will accumulate the full argument first, then spend memory and CPU parsing or repairing it, which can delay agent turns, degrade service responsiveness, or make the shared process unavailable.
Verified on commit 61206ba73479db054921594a57b7df1c82694d29 / desktop version 2.1.6 with a safe local PoC. |
|---|
| Source | ⚠️ https://github.com/lche511/cve/tree/main/CowAgent_Tool_Call_Arguments_JSON_Repair_DoS_Report |
|---|
| User | pengguogood (UID 72903) |
|---|
| Submission | 09/03/2026 11:57 (1 month ago) |
|---|
| Moderation | 10/11/2026 09:20 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 416550 [zhayujie CowAgent up to 2.2.0 Streaming Tool-Call Argument json.loads allocation of resources] |
|---|
| Points | 20 |
|---|