| शीर्षक | NousResearch hermes-agent 0.18.0 Denial of Service |
|---|
| विवरण | Hermes Agent 0.18.2 contains a denial of service vulnerability in the MCP tool discovery and MCP resource/tool result workflow.
When MCP is enabled, a normal authenticated chat request can cause Hermes to discover MCP tools and invoke MCP tools or resources as part of the agent workflow. This path does not enforce effective server-side limits on MCP tool count, tool description size, input schema size/depth, resource content size, or tool result size.
A malicious or abnormal MCP server can turn a normal agent task into resource amplification, causing excessive memory use, large model/tool context construction, repeated tool/resource processing, and exhaustion of shared chat capacity. In local reproduction, concurrent normal chat tasks using the MCP path exhausted shared chat run capacity and caused another normal chat request to be rejected with HTTP 429, demonstrating denial of service for legitimate users. |
|---|
| स्रोत | ⚠️ https://github.com/lche511/cve/blob/main/Hermes_MCP_Tool_Resource_Amplification_DoS_Report/REPORT.md |
|---|
| उपयोगकर्ता | pengguogood (UID 72903) |
|---|
| सबमिशन | 08/07/2026 01:36 PM (2 महीनों पहले) |
|---|
| संयम | 01/09/2026 05:49 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 397720 [NousResearch hermes-agent तक 0.18.2 MCP Tool tools/mcp_tool.py list_tools सेवा अस्वीकार] |
|---|
| अंक | 20 |
|---|