EUVD-2026-41670
GHSA-w268-f7gg-hc49
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
HTTP API is network-reachable (AV:N), low complexity (AC:L), requires low-privilege auth (PR:L); only limited availability impact on the agent process (A:L), no C/I impact.
Primary rating from Vendor (vuldb).
CVSS VectorVendor: vuldb
Lifecycle Timeline
1DescriptionCVE.org
A weakness has been identified in NousResearch hermes-agent up to 2026.4.30. The impacted element is the function AIAgent.run_conversation of the file run_agent.py of the component HTTP API. This manipulation of the argument todos causes denial of service. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Denial of service in NousResearch hermes-agent (versions up to 2026.4.30) is triggered by manipulating the todos argument passed to the AIAgent.run_conversation function via the HTTP API in run_agent.py. An authenticated remote attacker can send a crafted request to crash or resource-exhaust the agent process, disrupting availability for legitimate users. No public exploit identified at time of analysis is incorrect here - a public exploit exists (E:P in CVSS 4.0 vector; GitHub Gist referenced), and the vendor has not responded to disclosure, leaving no patch available.
Technical ContextAI
hermes-agent is an AI agent orchestration framework by NousResearch, exposing an HTTP API for driving agent workflows. The vulnerable code path is the AIAgent.run_conversation function in run_agent.py, which processes a todos argument representing task instructions passed to the agent. CWE-404 (Improper Resource Shutdown or Release) indicates the root cause is failure to properly release or bound resources when processing this argument - likely unbounded input, an unclosed resource handle, or an unhandled exception path that leaves the process in a degraded or crashed state. No CPE string was provided, so affected version enumeration relies solely on the VulDB-reported range of up to and including 2026.4.30.
RemediationAI
No vendor-released patch has been identified at time of analysis - the vendor did not respond to coordinated disclosure. As a primary compensating control, restrict access to the hermes-agent HTTP API to explicitly trusted, authenticated principals only, and enforce strict input validation or schema enforcement on the todos parameter at the API gateway or reverse proxy layer (e.g., reject oversized or malformed payloads before they reach the application). If the HTTP API is not required in a given deployment, disabling it entirely eliminates the attack surface with no functional trade-off for offline or CLI-only use cases. Rate-limiting requests to the affected endpoint will reduce the impact of repeated DoS attempts. Monitor the exploit details published at https://gist.github.com/YLChen-007/b91a85f9448beadebe25d37a3f4fd760 and the VulDB entry at https://vuldb.com/vuln/376142 for any vendor response or community-supplied patches.
Same weakness CWE-404 – Improper Resource Shutdown or Release
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today