---
id: CVE-2026-108768
title: A vulnerability was identified in zhayujie CowAgent up to 2.2.0
summary: >-
  A vulnerability was identified in zhayujie CowAgent up to 2.2.0. Affected by
  this issue is the function json.loads of the component Streaming Tool-Call
  Argument Handler. The manipulation leads to allocation of resources. It is
  possible t…
severity: medium
cvss: 4.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L'
cwe:
  - CWE-400
  - CWE-770
published: '2026-10-11'
updated: '2026-10-11'
sourceUpdated: '2026-10-11T19:16:32.870'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-108768'
references:
  - url: >-
      https://github.com/lche511/cve/tree/main/CowAgent_Tool_Call_Arguments_JSON_Repair_DoS_Report
    label: cna@vuldb.com
  - url: 'https://vuldb.com/cve/CVE-2026-108768'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/submit/958026'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/416550'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/416550/cti'
    label: cna@vuldb.com
tags:
  - nvd
ingestedAt: '2026-10-12T14:50:34.069Z'
---

## Overview

A vulnerability was identified in zhayujie CowAgent up to 2.2.0. Affected by this issue is the function json.loads of the component Streaming Tool-Call Argument Handler. The manipulation leads to allocation of resources. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.