| 제목 | NousResearch hermes-agent 0.18.0 Denial of Service |
|---|
| 설명 | Hermes Agent 0.18.0 contains a denial of service vulnerability in the API Server session chat interface.
Hermes Agent enforces a shared max_concurrent_runs limit on OpenAI-compatible API endpoints, but the session chat endpoints do not apply the same concurrency admission check before starting backend agent execution.
An authenticated attacker with API Server access can create multiple normal sessions and send concurrent prompt-driven long-running chat requests. This can occupy shared agent execution and model-provider capacity beyond the configured limit. In local reproduction using the default max_concurrent_runs value of 10, twelve concurrent session chat requests were accepted, while a normal chat-completion request was rejected with HTTP 429 Too many concurrent runs.
This can make the OpenAI-compatible chat service unavailable to legitimate users and consume shared backend execution capacity and upstream model-provider quota. |
|---|
| 원천 | ⚠️ https://github.com/hackerguopeng/cve/tree/main/Hermes_API_Server_Session_Chat_DoS_Report |
|---|
| 사용자 | hackerguopeng (UID 99623) |
|---|
| 제출 | 2026. 07. 08. AM 06:20 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 09. 01. PM 05:48 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 397718 [NousResearch hermes-agent 0.18.0 Session Chat Interface api_server.py 서비스 거부] |
|---|
| 포인트들 | 20 |
|---|