| Título | NousResearch hermes-agent 0.18.0 Denial of Service |
|---|
| Descrição | Hermes Agent 0.18.0 contains a denial of service vulnerability in the API Server session chat interface.
Hermes Agent enforces a shared max_concurrent_runs limit on OpenAI-compatible API endpoints, but the session chat endpoints do not apply the same concurrency admission check before starting backend agent execution.
An authenticated attacker with API Server access can create multiple normal sessions and send concurrent prompt-driven long-running chat requests. This can occupy shared agent execution and model-provider capacity beyond the configured limit. In local reproduction using the default max_concurrent_runs value of 10, twelve concurrent session chat requests were accepted, while a normal chat-completion request was rejected with HTTP 429 Too many concurrent runs.
This can make the OpenAI-compatible chat service unavailable to legitimate users and consume shared backend execution capacity and upstream model-provider quota. |
|---|
| Fonte | ⚠️ https://github.com/hackerguopeng/cve/tree/main/Hermes_API_Server_Session_Chat_DoS_Report |
|---|
| Utilizador | hackerguopeng (UID 99623) |
|---|
| Submissão | 08/07/2026 06h20 (há 2 meses) |
|---|
| Moderação | 01/09/2026 17h48 (2 months later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 397718 [NousResearch hermes-agent 0.18.0 Session Chat Interface api_server.py Negação de Serviço] |
|---|
| Pontos | 20 |
|---|