CVE-2026-14626: NousResearch Hermes-Agent DoS Vulnerability

CVE-2026-14626 Overview

CVE-2026-14626 is a denial of service vulnerability affecting NousResearch hermes-agent versions up to 2026.4.30. The flaw resides in the AIAgent.run_conversation function within run_agent.py, which is part of the HTTP API component. Attackers can manipulate the todos argument to trigger resource exhaustion and disrupt service availability. The attack is remotely exploitable and requires low-level privileges. A public exploit has been released, increasing the likelihood of opportunistic attacks. The vendor was contacted prior to public disclosure but did not respond, leaving affected deployments without official remediation guidance.

Critical Impact
Remote attackers with low privileges can send crafted todos payloads to the HTTP API to induce denial of service in the hermes-agent runtime.

Affected Products

NousResearch hermes-agent versions up to and including 2026.4.30
Deployments exposing the hermes-agent HTTP API to untrusted networks
Integrations invoking AIAgent.run_conversation in run_agent.py

Discovery Timeline

2026-07-04 - CVE-2026-14626 published to NVD
2026-07-07 - Last updated in NVD database

Technical Details for CVE-2026-14626

Vulnerability Analysis

The vulnerability is categorized under [CWE-404] Improper Resource Shutdown or Release. The affected function AIAgent.run_conversation in run_agent.py processes the todos argument received through the HTTP API without adequate constraints on resource consumption. An authenticated remote attacker can submit a manipulated todos parameter that causes the agent to exhaust resources or fail to release them, resulting in denial of service. Because hermes-agent is an AI agent framework, disruption of the runtime affects downstream automation and conversational workflows relying on the service.

Root Cause

The root cause is improper handling of the todos argument within the conversation loop. The function does not enforce sufficient bounds or lifecycle controls on task-related resources. When an attacker supplies crafted input, the agent enters a state where it cannot properly reclaim or terminate resources, degrading availability.

Attack Vector

The attack is initiated over the network against the HTTP API. The attacker requires low-level authentication but no user interaction. A public proof-of-concept is available on GitHub Gist, published by the reporter. Technical details are described in the GitHub Gist PoC and the VulDB CVE-2026-14626 entry.

Detection Methods for CVE-2026-14626

Indicators of Compromise

Unusually large or malformed todos payloads in HTTP requests to the hermes-agent API
Sudden spikes in CPU, memory, or file descriptor usage on hosts running run_agent.py
Repeated AIAgent.run_conversation invocations from a single source followed by service unresponsiveness

Detection Strategies

Instrument the HTTP API to log request sizes and structure of the todos argument for offline analysis
Baseline normal request patterns to hermes-agent endpoints and alert on statistical deviations
Correlate authentication events with abnormal request volumes to identify low-privilege abuse

Monitoring Recommendations

Monitor process-level metrics for the hermes-agent runtime and generate alerts on sustained resource pressure
Track HTTP 5xx response rates and request latency on the API endpoint
Review authentication logs for accounts making disproportionate calls to conversation endpoints

How to Mitigate CVE-2026-14626

Immediate Actions Required

Restrict network exposure of the hermes-agent HTTP API to trusted management networks only
Enforce input size limits and schema validation on the todos argument at an upstream proxy
Rotate and scope credentials used by clients of hermes-agent to reduce blast radius
Deploy rate limiting on the AIAgent.run_conversation endpoint

Patch Information

No vendor patch is available. According to the disclosure, NousResearch did not respond to the reporter. Operators should track the VulDB Vulnerability #376142 record for future updates and monitor the upstream project for new releases beyond version 2026.4.30.

Workarounds

Place hermes-agent behind a reverse proxy that enforces request body size and JSON depth limits
Configure a Web Application Firewall rule to reject requests with anomalous todos structures
Run hermes-agent under strict cgroup or container resource limits to contain exhaustion attempts
Disable public exposure of the HTTP API until a fixed release is available

bash

# Example reverse proxy limits (nginx)
client_max_body_size 64k;
limit_req_zone $binary_remote_addr zone=hermes:10m rate=10r/m;
location /run_conversation {
    limit_req zone=hermes burst=5 nodelay;
    proxy_pass http://hermes_agent_upstream;
}