| शीर्षक | NousResearch hermes-agent 0.18.0 Denial of Service |
|---|
| विवरण | Hermes Agent 0.18.0 contains a denial of service vulnerability in the API Server session chat interface.
Hermes Agent enforces a shared max_concurrent_runs limit on OpenAI-compatible API endpoints, but the session chat endpoints do not apply the same concurrency admission check before starting backend agent execution.
An authenticated attacker with API Server access can create multiple normal sessions and send concurrent prompt-driven long-running chat requests. This can occupy shared agent execution and model-provider capacity beyond the configured limit. In local reproduction using the default max_concurrent_runs value of 10, twelve concurrent session chat requests were accepted, while a normal chat-completion request was rejected with HTTP 429 Too many concurrent runs.
This can make the OpenAI-compatible chat service unavailable to legitimate users and consume shared backend execution capacity and upstream model-provider quota. |
|---|
| स्रोत | ⚠️ https://github.com/hackerguopeng/cve/tree/main/Hermes_API_Server_Session_Chat_DoS_Report |
|---|
| उपयोगकर्ता | hackerguopeng (UID 99623) |
|---|
| सबमिशन | 08/07/2026 06:20 AM (2 महीनों पहले) |
|---|
| संयम | 01/09/2026 05:48 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 397718 [NousResearch hermes-agent 0.18.0 Session Chat Interface api_server.py सेवा अस्वीकार] |
|---|
| अंक | 20 |
|---|