Executive brief
Agent-S is an AI agent framework that includes an OCR (optical character recognition) service for document and image processing. An attacker can send a specially crafted HTTP request with an extremely large image file to the OCR endpoint, causing the service to consume excessive memory and CPU resources, resulting in denial of service and making the agent unavailable to legitimate users.
Technical details
The vulnerability is a denial-of-service condition in the OCR HTTP API endpoint (/ocr/) of Agent-S. The ImageData request model accepts an unbounded img_bytes field without any Content-Length, decoded byte-size, or resource consumption limits. FastAPI and Pydantic fully materialize the attacker-controlled JSON request body in memory before the application can reject it based on size. The base64-encoded bytes are then decoded and passed to image parsing and OCR processing without pre-boundary constraints. An unauthenticated attacker on the network can send a request with a multi-gigabyte img_bytes value, exhausting worker memory or CPU and crashing the OCR service or monopolizing OCR workers. No authentication is required and the attack is remotely exploitable.
Affected products
- simular-ai Agent-S up to 0.3.2
Timeline
- 2026-09-03: disclosed: Publicly disclosed vulnerability with proof-of-concept
- 2026-09-03: other: Vendor contacted early but did not respond