Description

A vulnerability was identified in zhayujie CowAgent up to 2.2.0. Affected by this issue is the function json.loads of the component Streaming Tool-Call Argument Handler. The manipulation leads to allocation of resources. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-10-11T19:16:32.870Z",
  "pubdate": "2026-10-11T19:16:32.870Z",
  "executiveSummary": "A resource exhaustion vulnerability exists in zhayujie CowAgent up to version 2.2.0, specifically within the Streaming Tool-Call Argument Handler component.\nThe vulnerability arises from insecure deserialization processes involving the json.loads function, which allows an attacker to trigger uncontrolled resource allocation.\nThis flaw facilitates a Denial of Service (DoS) condition by exhausting system memory or CPU resources through crafted network-based input.\nThe vulnerability is remotely exploitable without requiring authentication, posing a significant risk to system availability.\nGiven that exploit code is publicly available, the attack surface is active and requires immediate attention despite the lack of vendor response to early disclosure notifications.",
  "technicalDetails": "The vulnerability is situated in the Streaming Tool-Call Argument Handler component of CowAgent, specifically targeting the implementation of the json.loads function. In Python, the json.loads function is a standard deserializer that transforms a JSON-formatted string into a native Python dictionary or list. The vulnerability occurs because the application processes streaming input without implementing size limits or validation schemas prior to invoking the deserialization routine.\nWhen the application receives malicious input, the json.loads function attempts to reconstruct complex, deeply nested, or excessively large JSON structures provided by the remote attacker. Because the component handles streaming data, an attacker can craft a payload that defines a vast number of objects or recursive structures that occupy significant heap memory. This leads to an unrestricted allocation of memory resources as the parser attempts to map the serialized input into memory.\nThe attack flow proceeds as follows: First, the attacker identifies the network endpoint responsible for the Streaming Tool-Call Argument Handler. Second, the attacker transmits a specially crafted, maliciously formatted JSON string over the network protocol. Third, the application's argument handler passes this unchecked payload directly into json.loads. Fourth, the parser recursively allocates objects in memory to accommodate the payload's structure. If the payload is sufficiently complex, this process forces the application to consume its available memory allocation, potentially triggering an Out-of-Memory (OOM) error or causing the process to hang while waiting for resource completion, effectively resulting in a denial-of-service condition.\nThis vulnerability is classified as remote because the argument handler component processes input sourced from external clients. No authentication or elevated privilege is required to initiate the request, making the exploitation process straightforward. Because the vendor has not provided a patch for versions up to 2.2.0, the system remains vulnerable to any actor capable of reaching the streaming interface. The exploitation of this issue directly impacts service availability and can potentially interfere with underlying system stability if the service is run without sufficient process-level constraints."
}