Description
A weakness has been identified in NousResearch hermes-agent up to 2026.4.30. The impacted element is the function AIAgent.run_conversation of the file run_agent.py of the component HTTP API. This manipulation of the argument todos causes denial of service. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-07-04
Score: 5.3 Medium
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A weakness in the HTTP API of NousResearch hermes-agent allows a remote attacker to manipulate the 'todos' argument of the AIAgent.run_conversation function in run_agent.py. The manipulation causes excessive resource consumption, leading the service to become unresponsive and resulting in a denial of service (CWE‑404). The flaw does not reveal or alter data and does not provide privilege escalation or remote code execution.

Affected Systems

NousResearch hermes 2026.4.30 are affected. The vulnerability resides in the HTTP API component of the product Hermès‑Agent delivered by NousResearch.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate risk, while the EPSS score of <1% suggests a very low but nonzero exploitation probability. It is not listed in the CISA KEV catalog, yet a public exploit is available and can be triggered remotely via API traffic, leading to service interruption without data compromise.

Generated by OpenCVE AI on July 25, 2026 at 21:16 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply any vendor‑provided patch for the run_conversation flaw once released.
  • Restrict access to the Hermès‑Agent HTTP API endpoint via firewall or IP whitelisting to limit exposure.
  • Enforce input validation or size limits on the 'todos' argument to prevent excessive resource consumption (CWE-404).
  • Monitor service logs and implement rate‑limiting to detect and mitigate abusive traffic.

Generated by OpenCVE AI on July 25, 2026 at 21:16 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 07 Jul 2026 03:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Sat, 04 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in NousResearch hermes-agent up to 2026.4.30. The impacted element is the function AIAgent.run_conversation of the file run_agent.py of the component HTTP API. This manipulation of the argument todos causes denial of service. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title NousResearch hermes-agent HTTP API run_agent.py AIAgent.run_conversation denial of service
First Time appeared Nousresearch
Nousresearch hermes-agent
Weaknesses CWE-404
CPEs cpe:2.3:a:nousresearch:hermes-agent:*:*:*:*:*:*:*:*
Vendors & Products Nousresearch
Nousresearch hermes-agent
References
Metrics cvssV2_0

{'score': 4, 'vector': 'AV:N/AC:L/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Nousresearch Hermes-agent
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-07-07T02:29:27.952Z

Reserved: 2026-07-03T17:07:48.069Z

Link: CVE-2026-14626

cve-icon Vulnrichment

Updated: 2026-07-07T02:29:23.245Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-25T21:30:17Z

Weaknesses
  • CWE-404

    Improper Resource Shutdown or Release