CVE-2026-2108

MediumPublic PoC

Published: 07 February 2026

Published

07 February 2026

Modified

27 February 2026

KEV Added

—

Patch

—

CVSS Score 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS Score 0.0004 12.5th percentile

Risk Priority 11 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-2108 is a medium-severity Improper Resource Shutdown or Release (CWE-404) vulnerability in Jsbroks Coco Annotator. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 12.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploit Public-Facing Application (T1190) and 1 other technique.

Threat & Defense Details

Likely Mitigating ControlsAI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

CP-5 Contingency Plan Update

addresses: CWE-404

Contingency plan updates incorporate proper resource shutdown and release steps, preventing attackers from leveraging incomplete cleanup during recovery scenarios.

SC-10 Network Disconnect

addresses: CWE-404

Mandates explicit shutdown of the network connection at session conclusion, directly addressing improper resource release.

SC-4 Information in Shared System Resources

addresses: CWE-404

Requires proper shutdown/release procedures that include overwriting or isolating data to block unintended transfer via reused system objects.

SI-17 Fail-safe Procedures

addresses: CWE-404

Procedures can mandate orderly shutdown or release of resources when failures occur, preventing improper resource handling after a fault.

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1499.003 Application Exhaustion Flood Impact

Adversaries may target resource intensive features of applications to cause a denial of service (DoS), denying availability to those applications.

attack.mitre.org →

Why these techniques?

Direct unauthenticated remote exploitation of public /api endpoint to trigger application resource exhaustion (task queue flood) for DoS.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

A vulnerability was determined in jsbroks COCO Annotator up to 0.11.1. This impacts an unknown function of the file /api/info/long_task of the component Endpoint. This manipulation causes denial of service. The attack may be initiated remotely. The exploit has been…

publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

Deeper analysisAI

CVE-2026-2108 is a denial-of-service vulnerability in jsbroks COCO Annotator versions up to 0.11.1. It affects an unknown function within the /api/info/long_task endpoint of the component. The issue, classified as CWE-404, has a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) and was published on 2026-02-07.

Unauthenticated remote attackers can exploit this vulnerability with low attack complexity and no user interaction. By manipulating the endpoint, attackers can initiate a task queue flood, resulting in low-impact availability disruption through denial of service.

Advisories from VulDB and a GitHub vulnerability research disclosure indicate that the exploit has been publicly released and may be utilized. The vendor was contacted early regarding the issue but provided no response, and no patches or mitigations are detailed in the references.

Notable context includes the public availability of the exploit, increasing the risk for exposed instances of COCO Annotator.