Description

A security vulnerability has been detected in zhayujie CowAgent up to 2.1.9. The impacted element is an unknown function of the component Media Download Handler. Such manipulation leads to uncontrolled memory allocation. It is possible to launch the attack remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.2.0 is sufficient to resolve this issue. The name of the patch is b7967210268fc4c0afea1078223e74e7e96a8a54. You should upgrade the affected component.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-10-11T15:16:52.780Z",
  "pubdate": "2026-10-11T15:16:52.780Z",
  "executiveSummary": "A critical vulnerability has been identified in the Media Download Handler component of zhayujie CowAgent versions up to and including 2.1.9, involving uncontrolled memory allocation.\nThis flaw allows a remote, unauthenticated attacker to trigger excessive memory consumption, which can lead to a denial-of-service (DoS) condition by exhausting system resources.\nThe vulnerability is currently subject to public disclosure, meaning functional exploit code may be readily available for malicious actors to leverage against vulnerable instances.\nBecause the attack vector is remote, the risk is significant for any deployment exposed to untrusted network traffic.\nImmediate remediation is required, as the vulnerability resides in core media processing logic that could be targeted to crash the application or destabilize the underlying host environment.\nThe scope of impact is limited to the application process, but the ability to remotely trigger memory exhaustion effectively compromises service availability.",
  "technicalDetails": "The vulnerability exists within the Media Download Handler component of CowAgent, specifically due to improper handling of resource allocation requests during the media acquisition phase.\nThe root cause is an uncontrolled memory allocation flaw, where the application fails to adequately validate or limit the size of data structures or memory buffers allocated based on user-supplied input during the download process.\nAttackers can exploit this by sending specially crafted requests to the Media Download Handler that specify large or malformed parameters, forcing the process to allocate memory beyond reasonable bounds.\nThe attack flow begins with the attacker identifying the target endpoint responsible for media downloads. By transmitting a request containing malicious input parameters designed to trigger the vulnerable allocation path, the attacker induces the application to allocate excessive memory chunks.\nSince the allocation request is not constrained by appropriate bounds checking or size validation, the process memory usage will grow rapidly, potentially leading to an out-of-memory (OOM) state.\nIf the operating system's OOM killer does not intervene, the application may become unresponsive, effectively causing a remote denial-of-service.\nBecause the vulnerability is exploitable remotely, no local access is required to initiate the payload. The lack of documented authentication requirements for this specific handler suggests that an unauthenticated remote attacker can successfully trigger the memory exhaustion state.\nThis vulnerability affects all zhayujie CowAgent versions up to 2.1.9. The flaw is addressed in version 2.2.0, specifically through the implementation of corrected logic represented by patch b7967210268fc4c0afea1078223e74e7e96a8a54, which introduces rigorous input validation or memory ceiling constraints to prevent unbounded allocations.\nPost-exploitation, the primary impact is service disruption. However, in certain memory-managed environments, uncontrolled allocation can sometimes be leveraged to influence heap layout, though the primary concern here is the exhaustion of system-wide resources causing a crash."
}