CVE-2026-2108
📋 TL;DR
An unauthenticated denial-of-service vulnerability in jsbroks COCO Annotator allows remote attackers to flood the task queue via the /api/info/long_task endpoint. This affects all COCO Annotator installations up to version 0.11.1 that expose the vulnerable endpoint.
💻 Affected Systems
- jsbroks COCO Annotator
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability for all users, potentially disrupting annotation workflows and causing data loss for in-progress tasks.
Likely Case
Temporary service degradation or unavailability until the attack stops or system resources are restored.
If Mitigated
Minimal impact with proper network segmentation and rate limiting in place.
🎯 Exploit Status
Public exploit details available in GitHub repository. Simple HTTP requests can trigger the vulnerability.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: None available
Restart Required: No
Instructions:
No official patch available. Consider upgrading to any version above 0.11.1 if available, or implement workarounds.
🔧 Temporary Workarounds
Network Access Control
linuxRestrict access to the /api/info/long_task endpoint using firewall rules or web application firewall.
iptables -A INPUT -p tcp --dport [COCO_PORT] -m string --string "/api/info/long_task" --algo bm -j DROP
Rate Limiting
allImplement rate limiting on the vulnerable endpoint to prevent flooding.
nginx: limit_req_zone $binary_remote_addr zone=coco:10m rate=10r/s;
apache: mod_ratelimit
🧯 If You Can't Patch
- Segment the COCO Annotator instance behind a reverse proxy with strict rate limiting.
- Monitor for unusual traffic patterns to the /api/info/long_task endpoint and implement alerting.
🔍 How to Verify
Check if Vulnerable:
Check if COCO Annotator version is ≤0.11.1 and the /api/info/long_task endpoint is accessible via HTTP requests.Check Version:
Check the application interface or configuration files for version information.Verify Fix Applied:
Test if the /api/info/long_task endpoint is no longer accessible or properly rate-limited.📡 Detection & Monitoring
Log Indicators:
- High frequency of requests to /api/info/long_task
- Increased error rates or timeout messages
Network Indicators:
- Unusual spike in traffic to the COCO Annotator port
- Multiple rapid HTTP POST/GET requests to the vulnerable endpoint
SIEM Query:
source="coco-annotator" AND (url_path="/api/info/long_task" AND request_count > 100)