CVE-2026-108683: zhayujie CowAgent RCE Vulnerability

CVE-2026-108683 Overview

CVE-2026-108683 is an uncontrolled resource consumption vulnerability [CWE-400] in zhayujie CowAgent versions up to 2.1.9. The flaw resides in the Media Download Handler component, where remote media fetches are not properly bounded. An authenticated remote attacker can trigger excessive memory allocation by referencing oversized media resources. The exploit has been publicly disclosed, increasing the likelihood of opportunistic use against exposed deployments. Upgrading to version 2.2.0 resolves the issue via commit b7967210268fc4c0afea1078223e74e7e96a8a54.

Critical Impact
Remote attackers with low privileges can exhaust process memory on CowAgent instances, degrading service availability for channel integrations such as Feishu.

Affected Products

zhayujie CowAgent versions up to and including 2.1.9
CowAgent Media Download Handler (Feishu channel integration)
Fixed in CowAgent 2.2.0

Discovery Timeline

2026-10-11 - CVE-2026-108683 published to NVD
2026-10-13 - Last updated in NVD database

Technical Details for CVE-2026-108683

Vulnerability Analysis

The vulnerability affects the media download path used by CowAgent's channel integrations. The handler retrieves remote media over HTTP without consistently enforcing a maximum byte limit before reading response data into memory. An attacker who can submit or reference a message containing a large or deceptively sized media object causes the server to allocate memory proportional to the response body.

Because the download logic was duplicated across channel modules, enforcement of the Content-Length check and streaming limits was inconsistent. Repeated requests against a vulnerable instance can exhaust process memory and interrupt service for legitimate users. The fix consolidates all media downloads into a single common/media_download module with centrally enforced bounds MAX_FILE_BYTES and MAX_IMAGE_BYTES.

Root Cause

The root cause is unbounded or inconsistently bounded reads from attacker-influenced URLs. The pre-patch _download_remote_bytes function in channel/feishu/feishu_channel.py and download_resource in channel/feishu/resource_download.py each implemented their own size handling. Attackers could abuse paths where the declared size check was skipped or where streamed bytes exceeded the declared Content-Length.

Attack Vector

The attack is network-reachable and requires low privileges, such as the ability to send a message with media content through a connected channel. No user interaction is needed on the victim side. The impact is limited to availability of the CowAgent service.

python

# Pre-patch logic removed in commit b7967210268fc4c0afea1078223e74e7e96a8a54
# channel/feishu/feishu_channel.py
-MAX_REMOTE_IMAGE_BYTES = 20 * 1024 * 1024
-MAX_REMOTE_FILE_BYTES = 50 * 1024 * 1024
-
-def _download_remote_bytes(url, max_bytes):
-    """Return a bounded remote body for multipart upload, or None on failure."""
-    response = None
-    try:
-        response = requests.get(url, stream=True, timeout=(5, 30))
-        if response.status_code != 200:
-            logger.error(f"[FeiShu] remote media download failed: status={response.status_code}")
-            return None
-        length = response.headers.get("Content-Length")
-        try:
-            declared_size = int(length) if length is not None else None
-        except (TypeError, ValueError):
-            declared_size = None
-        if declared_size is not None and declared_size > max_bytes:
-            raise ValueError("remote media exceeds download limit")

# Replaced by a shared helper:
+from common.media_download import MAX_FILE_BYTES, MAX_IMAGE_BYTES, download_bytes
# Source: https://github.com/zhayujie/CowAgent/commit/b7967210268fc4c0afea1078223e74e7e96a8a54

Detection Methods for CVE-2026-108683

Indicators of Compromise

Spikes in resident memory (RSS) of the CowAgent process without a corresponding increase in legitimate message volume.
Repeated inbound messages that reference large or missing-Content-Length media URLs through the Feishu channel.
Log entries from [FeiShu] indicating repeated media download failures or oversized media rejections.

Detection Strategies

Monitor the CowAgent process for abnormal memory growth and OOM-killer events in system logs.
Inspect reverse-proxy or egress logs for outbound GET requests to attacker-controlled URLs returning multi-megabyte payloads.
Alert on repeated media-handling exceptions emitted from channel/feishu/feishu_channel.py or channel/feishu/resource_download.py.

Monitoring Recommendations

Track per-channel message rates and media download sizes to baseline normal activity.
Capture process-level metrics (RSS, CPU, open sockets) and forward them to centralized observability.
Correlate availability incidents with inbound media URLs to identify abusive sources.

How to Mitigate CVE-2026-108683

Immediate Actions Required

Upgrade CowAgent to version 2.2.0 or later, which applies commit b7967210268fc4c0afea1078223e74e7e96a8a54.
Restrict which identities and channels can send media to the CowAgent instance.
Place CowAgent behind a reverse proxy that enforces request-rate limits and response-size caps for outbound fetches.

Patch Information

The fix is included in CowAgent Release v2.2.0. It unifies previously duplicated download logic into common/media_download, enforcing MAX_FILE_BYTES and MAX_IMAGE_BYTES consistently across all channels. See the GitHub Commit Details and the GitHub DoS Report for the technical write-up.

Workarounds

If immediate upgrade is not possible, run CowAgent with strict memory limits (for example, container --memory caps) so a single abusive download cannot destabilize the host.
Block or filter inbound messages from untrusted senders at the channel integration layer until the patch is applied.
Add an egress proxy rule that aborts downloads exceeding 50 MB from CowAgent to protect against oversized media fetches.

bash

# Example container memory cap and upgrade commands
git clone https://github.com/zhayujie/CowAgent.git
cd CowAgent
git checkout 2.2.0

docker run --name cowagent \
  --memory=512m --memory-swap=512m \
  --restart=on-failure \
  cowagent:2.2.0