Hermes Agent Vulnerability Enables Memory Exhaustion Attacks

• •Hermes Agent's public authentication routes are vulnerable to memory exhaustion attacks.
• •Attackers can send oversized payloads, leading to significant memory consumption.
• •No CVEs have been issued, and the vulnerability remains unpatched.

A vulnerability in Hermes Agent allows unauthenticated clients to exploit public authentication routes, leading to memory exhaustion. The affected routes include /auth/native/token, /auth/native/refresh, and /auth/password-login, which do not impose size limits on JSON request bodies. As a result, attackers can send oversized payloads that consume significant memory before being rejected. Testing showed that sending multiple large uploads can increase memory usage from 721 MiB to 1.08 GiB. This creates a denial-of-service risk, although requests are ultimately rejected. The issue is attributed to the FastAPI framework and its configuration in the Hermes Agent dashboard. No CVEs have been reported for this vulnerability yet. The current status remains, and organizations using Hermes Agent are advised to monitor their systems closely.