CVE-2026-2108
Published: 07 February 2026
Summary
CVE-2026-2108 is a medium-severity Improper Resource Shutdown or Release (CWE-404) vulnerability in Jsbroks Coco Annotator. Its CVSS base score is 5.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 24.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-3 (Access Enforcement) and SC-5 (Denial-of-service Protection).
Deeper analysis
CVE-2026-2108 is a denial-of-service vulnerability in jsbroks COCO Annotator versions up to 0.11.1. It affects an unknown function within the /api/info/long_task endpoint of the component. The issue, classified as CWE-404, has a CVSS v3.1 base score of 5.3 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) and was published on 2026-02-07.
Unauthenticated remote attackers can exploit this vulnerability with low attack complexity and no user interaction. By manipulating the endpoint, attackers can initiate a task queue flood, resulting in low-impact availability disruption through denial of service.
Advisories from VulDB and a GitHub vulnerability research disclosure indicate that the exploit has been publicly released and may be utilized. The vendor was contacted early regarding the issue but provided no response, and no patches or mitigations are detailed in the references.
Notable context includes the public availability of the exploit, increasing the risk for exposed instances of COCO Annotator.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-5719
Vulnerability details
A vulnerability was determined in jsbroks COCO Annotator up to 0.11.1. This impacts an unknown function of the file /api/info/long_task of the component Endpoint. This manipulation causes denial of service. The attack may be initiated remotely. The exploit has been…
more
publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct unauthenticated remote exploitation of public /api endpoint to trigger application resource exhaustion (task queue flood) for DoS.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires mechanisms to protect against or limit the effects of denial-of-service attacks targeting endpoints such as /api/info/long_task.
Enforces authenticated and authorized access to the vulnerable API endpoint, blocking unauthenticated remote exploitation.
Limits concurrent sessions or task submissions, mitigating task-queue flooding that produces the availability impact.