The vulnerability resides in the _handle_webhook_request function of the feishu.py component in NousResearch Hermes Agent. It permits an attacker to send crafted webhook requests that cause excessive resource consumption. This overconsumption can degrade or interrupt service availability, effectively draining CPU or memory and resulting in denial of service. The weakness is a classic resource exhaustion flaw (CWE‑400) combined with an improper error handling flaw (CWE‑404).

Any installation of NousResearch Hermes Agent up to and including version 2026.4.30 is affected. No newer releases have been confirmed as fixed, and there are no public upgrade paths listed by the vendor at this time. The vulnerability specifically targets the webhook endpoint exposed by the feishu.py module.

The CVSS base score of 6.9 indicates a moderate severity, but the flaw can be triggered remotely with no authentication, making it readily exploitable. The exploit has been disclosed publicly and attackers could use it without delay until a patch is deployed. Because the EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, the likelihood of widespread exploitation remains uncertain, yet the server‑side nature of the attack and its ability to cause service interruption warrant vigilance.