EUVD-2026-70283
GHSA-5wcc-3m77-2xf5
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-accessible DoS requiring low-privilege authentication; no confidentiality or integrity impact; only partial availability loss per CWE-404 resource exhaustion.
Primary rating from Vendor (VulDB).
CVSS VectorVendor: VulDB
Lifecycle Timeline
4DescriptionCVE.org
A vulnerability has been found in simular-ai Agent-S 0.3.1/0.3.2. This impacts an unknown function of the file code_agent.py of the component CodeAgent. Such manipulation leads to denial of service. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
AnalysisAI
Denial of service in simular-ai Agent-S 0.3.1/0.3.2 allows authenticated remote attackers to crash or exhaust the CodeAgent service by sending crafted input to code_agent.py. The root cause is CWE-404 (Improper Resource Shutdown or Release), meaning a resource - likely a subprocess, file handle, or socket - is not properly released on certain code paths, enabling resource exhaustion. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Low-privilege authentication to the Agent-S service is required (PR:L per CVSS 4.0 vector) - unauthenticated attackers cannot exploit this directly. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 score of 5.3 (Medium) accurately reflects the limited blast radius: only availability is affected (VA:L), no confidentiality or integrity loss occurs, and low privileges are required (PR:L), preventing unauthenticated exploitation. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No vendor-released patch has been identified at time of analysis; the vendor did not respond to the researcher's responsible disclosure. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Uncontrolled resource consumption in simular-ai Agent-S up to version 0.3.2 allows remote unauthenticated attackers to e
Denial of service in simular-ai Agent-S up to version 0.3.2 allows low-privileged remote attackers to disrupt the GUI ac
Same weakness CWE-404 – Improper Resource Shutdown or Release
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today