CVE-2026-84886: Simular-AI Agent-S DOS Vulnerability

CVE-2026-84886 Overview

CVE-2026-84886 is a resource consumption vulnerability [CWE-400] affecting simular-ai Agent-S versions up to 0.3.2. The flaw resides in the ImageData function of gui_agents/s1/utils/ocr_server.py within the OCR HTTP API component. Attackers can manipulate the img_bytes argument to trigger uncontrolled resource consumption on the server. The vulnerability is remotely exploitable without authentication or user interaction. The exploit details have been publicly disclosed, and the vendor did not respond to disclosure attempts.

Critical Impact
Remote unauthenticated attackers can exhaust server resources on Agent-S OCR HTTP API instances, degrading availability of the OCR service and dependent agent workflows.

Affected Products

simular-ai Agent-S versions up to 0.3.2
Component: OCR HTTP API (gui_agents/s1/utils/ocr_server.py)
Function: ImageData

Discovery Timeline

2026-09-03 - CVE-2026-84886 published to NVD
2026-09-03 - Last updated in NVD database

Technical Details for CVE-2026-84886

Vulnerability Analysis

The vulnerability affects the OCR HTTP API server bundled with simular-ai Agent-S. The ImageData handler in gui_agents/s1/utils/ocr_server.py accepts an img_bytes argument that lacks sufficient validation on size or structural constraints. An attacker submitting crafted image payloads over HTTP can force the OCR pipeline to consume excessive memory or CPU cycles. The result is degraded service availability for downstream agent components that rely on OCR responses. Because the API is exposed over the network and requires no credentials, exploitation is straightforward. This behavior is categorized under CWE-400: Uncontrolled Resource Consumption.

Root Cause

The root cause is missing input validation on the img_bytes parameter passed to the ImageData function. The handler processes the supplied bytes as image data without enforcing bounds on payload size, decoded image dimensions, or memory allocation limits. Consequently, a single request can allocate resources disproportionate to its network footprint, enabling amplification of client effort into server-side exhaustion.

Attack Vector

An unauthenticated remote attacker sends HTTP requests to the exposed OCR API endpoint with a manipulated img_bytes body. Repeated or large requests progressively deplete server memory or CPU. The attacker requires only network reachability to the OCR service. Refer to the GitHub DoS Report and VulDB CVE-2026-84886 for the published proof-of-concept details.

No verified code examples are available. See the referenced advisory for reproduction details.

Detection Methods for CVE-2026-84886

Indicators of Compromise

Sustained high memory or CPU utilization on hosts running the Agent-S OCR HTTP API service.
Repeated HTTP requests to the OCR endpoint with abnormally large or malformed img_bytes payloads.
OCR service timeouts, crashes, or restarts correlated with inbound HTTP traffic spikes.

Detection Strategies

Inspect web server and reverse proxy access logs for outsized POST bodies targeting the OCR API path.
Correlate process resource metrics with request rates against ocr_server.py endpoints.
Alert on repeated 5xx responses or connection resets from the OCR service under load.

Monitoring Recommendations

Track memory and CPU utilization for the Agent-S OCR process and set thresholds for anomaly alerts.
Monitor HTTP request payload sizes and per-source request rates against the OCR endpoint.
Capture and retain access logs and process telemetry for post-incident forensic review.

How to Mitigate CVE-2026-84886

Immediate Actions Required

Restrict network access to the Agent-S OCR HTTP API using firewall rules, allowlists, or private network placement.
Place the OCR endpoint behind a reverse proxy that enforces request body size limits and rate limiting.
Audit exposed Agent-S deployments and remove internet-facing OCR services where not required.

Patch Information

No vendor patch is currently referenced in the advisory. The vendor was contacted but did not respond to the disclosure. Track the VulDB Vulnerability #398135 entry for future updates and monitor the simular-ai Agent-S project for releases beyond version 0.3.2.

Workarounds

Enforce a strict maximum HTTP request body size at the proxy or application layer to reject oversized img_bytes payloads.
Apply per-client rate limiting and connection quotas on the OCR endpoint.
Isolate the OCR service in a resource-constrained container with memory and CPU cgroup limits to contain exhaustion attempts.
Require authentication or network-level authorization (for example, mutual TLS or VPN) before allowing access to the OCR API.

bash

# Example NGINX reverse proxy configuration to cap request body size and rate limit
http {
    limit_req_zone $binary_remote_addr zone=ocr_rl:10m rate=5r/s;

    server {
        listen 443 ssl;
        server_name ocr.example.internal;

        client_max_body_size 2m;
        client_body_buffer_size 128k;

        location /ocr/ {
            limit_req zone=ocr_rl burst=10 nodelay;
            proxy_pass http://127.0.0.1:8000;
            proxy_read_timeout 10s;
        }
    }
}