EUVD-2026-37904
GHSA-hq7f-wv7c-w9mp
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Unauthenticated network endpoint with no complexity; unbounded thread and heap exhaustion from sustained flooding warrants A:H over A:L.
Primary rating from Vendor (VulnCheck).
CVSS VectorVendor: VulnCheck
Lifecycle Timeline
2DescriptionCVE.org
Hermes WebUI before 0.51.468 contains a resource exhaustion vulnerability in the unauthenticated POST /api/onboarding/oauth/start endpoint that allows unbounded accumulation of in-memory flow state and daemon threads. Attackers can send repeated or concurrent requests to exhaust server memory and thread resources, potentially triggering repeated outbound device-code requests to upstream OAuth providers.
AnalysisAI
Resource exhaustion in Hermes WebUI before 0.51.468 exposes an unauthenticated POST /api/onboarding/oauth/start endpoint that accumulates unbounded in-memory OAuth flow state and daemon polling threads with each incoming request, enabling remote denial of service without authentication. The root cause - confirmed by vendor release notes and fix commit ce272d9 - is the absence of any deduplication or serialization check before allocating a new flow entry and spawning a worker thread per request. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis.
Technical ContextAI
The affected product is identified by CPE cpe:2.3:a:nesquena:hermes-webui:*:*:*:*:*:*:*:*, covering all Hermes WebUI releases before 0.51.468. The vulnerability is classified as CWE-770 (Allocation of Resources Without Limits or Throttling). The vulnerable code path implements the OAuth 2.0 Device Authorization Grant flow: when a client POSTs to /api/onboarding/oauth/start, the server is expected to initiate a device-code request to an upstream OAuth provider and return the resulting user code and verification URI. Before the fix, the handler performed no atomic check-and-insert against existing pending flows - each request unconditionally created a new in-memory flow state entry and spawned a daemon polling worker to poll the upstream provider for token issuance. This meant concurrent or repeated requests for the same (provider, hermes_home) pair multiplied heap allocations and live threads without bound. The fix, documented in PR #3972 and merged in v0.51.468, introduced single-flight serialization per (provider, hermes_home) key using an atomic check-and-insert under the flows lock, so duplicate requests reuse the existing flow rather than creating new ones.
RemediationAI
Upgrade Hermes WebUI to version 0.51.468 or later, which resolves the issue by implementing single-flight serialization per (provider, hermes_home) pair under an atomic flows lock (fix commit: https://github.com/nesquena/hermes-webui/commit/ce272d9cd5f8e5a4521278f56eb5388010901646, release: https://github.com/nesquena/hermes-webui/releases/tag/v0.51.468). If immediate upgrade is not feasible, place a rate-limiting reverse proxy (such as nginx's limit_req_zone or an upstream WAF) in front of POST /api/onboarding/oauth/start to cap the request rate per source IP - this reduces the amplification window but does not eliminate the root cause and offers no protection against distributed sources. Alternatively, restrict network access to the /api/onboarding path to trusted internal IP ranges via firewall ACL, trading off accessibility for unauthenticated remote attack surface reduction. Neither compensating control prevents a determined attacker who controls multiple source addresses from triggering resource exhaustion; patching to v0.51.468 is the definitive remediation.
More in Hermes Webui
View allUnauthenticated remote code execution in Hermes WebUI before version 0.51.788 lets remote attackers run arbitrary shell
Authentication bypass in Hermes WebUI before 0.51.307 lets unauthenticated remote attackers reach onboarding endpoints t
Authentication bypass in Hermes WebUI before 0.51.409 allows unauthenticated remote attackers to register the first pass
Unauthenticated initial-setup hijack in Hermes WebUI before 0.51.358 allows any remote attacker who can reach the settin
Cross-profile authorization bypass in Hermes WebUI before 0.51.368 allows authenticated users to access sessions, files,
Arbitrary file deletion in Hermes WebUI (nesquena/hermes-webui, all versions prior to the PR #409 fix) allows an authent
Information disclosure in Hermes WebUI before v0.51.221 allows authenticated remote attackers to read arbitrary files ou
Cross-profile data disclosure in Hermes WebUI before 0.51.269 allows authenticated users to read session titles and tran
Cross-profile session data exfiltration in Hermes WebUI before 0.51.443 lets any authenticated user retrieve session tra
Cross-profile session disclosure in Hermes WebUI before 0.51.443 lets any authenticated user retrieve conversation trans
Resource exhaustion in Hermes WebUI before v0.51.270 allows unauthenticated remote attackers to degrade service availabi
Cross-profile workspace isolation bypass in Hermes WebUI before 0.51.521 allows an authenticated low-privilege user oper
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today