Executive brief
NousResearch hermes-agent is an AI agent framework that manages conversations and tasks. A vulnerability in its HTTP API allows an attacker to send specially crafted conversation histories that include fake task lists. This can overwhelm the system's memory or processing capacity for that session, leading to a denial of service where the AI agent becomes unresponsive or fails to process further requests.
Technical details
A denial of service (DoS) vulnerability exists in NousResearch hermes-agent up to version 2026.4.30 within the AIAgent.run_conversation function of run_agent.py. The vulnerability stems from the HTTP API server's failure to verify the authenticity or size of 'conversation_history' entries provided in API requests. Specifically, the _hydrate_todo_store function trusts any role='tool' message containing a 'todos' JSON object as authoritative output. An attacker with network access and basic API privileges can submit forged, oversized todo entries that are stored in TodoStore and subsequently re-injected into the model's context window. This leads to context exhaustion and session-specific denial of service. As of the advisory date, no patch is available.
Affected products
- NousResearch hermes-agent up to 2026.4.30
Timeline
- 2026-06-01: disclosed: Initial researcher gist published
- 2026-07-04: advisory: CVE published to NVD