A vulnerability was found in NousResearch hermes-agent up to 0.18.2. (CVE-2026-84289)

CVE-2026-84289 is a vulnerability in the NousResearch hermes-agent software, specifically affecting the list_tools function within the MCP Tool component (tools/mcp_tool.py). The vulnerability allows an attacker with low privileges to remotely trigger uncontrolled memory allocation, potentially leading to denial of service. The vulnerability has a CVSS 3.1 base score of 4.3 (low severity), indicating limited impact on confidentiality and integrity but an impact on availability. Public exploit code exists, and the vendor has not responded or provided a patch. No affected versions were explicitly stated beyond 'up to 0.18.2'.

The vulnerability can be exploited remotely by an attacker with low privileges to cause uncontrolled memory allocation, which may result in denial of service conditions. There is no impact on confidentiality or integrity according to the CVSS vector. No known exploits are reported in the wild beyond public exploit code availability.

No official patch or fix is currently available, and the vendor has not responded to disclosure. Users should monitor vendor communications for updates. Until a fix is released, consider restricting access to the affected component and applying any available workarounds if documented by the vendor. Patch status is not yet confirmed—check the vendor advisory for current remediation guidance.