CVE-2026-84287: NousResearch hermes-agent Session Chat api_server.py denial of service
A flaw has been found in NousResearch hermes-agent 0.18.0. Affected by this issue is some unknown functionality of the file gateway/platforms/apiserver.py of the component Session Chat Interface. This manipulation causes denial of service. The attack is possible to be carried out remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What level of access does an attacker need?
The attack can be performed remotely, but it requires low-level privileges. No user interaction is required.
Is public exploit code available?
Yes. An exploit has been published and may be used, increasing the likelihood of exploitation.
What is known about the affected deployment conditions?
The available information identifies hermes-agent 0.18.0 and the Session Chat Interface in gateway/platforms/api_server.py. It does not state whether the vulnerable functionality is enabled or exposed in a default configuration.
Is a vendor fix or response available?
The vendor was contacted early about the disclosure but did not respond. The provided information does not identify a patch, workaround, or vendor mitigation.