This vulnerability in NousResearch hermes-agent affects the _handle_webhook_request function within the gateway/platforms/feishu.py file. It allows remote attackers to trigger excessive resource consumption, potentially impacting service availability. The issue is present in all versions up to and including 2026.4.30. The vulnerability has a CVSS 4.0 base score of 6.9 (medium severity), indicating it is exploitable over the network without authentication and requires no user interaction. The vendor has not provided any remediation or response despite early contact, and no patches or fixes have been published.

Successful exploitation leads to resource consumption on the affected system, which may degrade performance or cause denial of service conditions. There is no indication of privilege escalation, data compromise, or other impacts beyond resource exhaustion. The vulnerability can be exploited remotely without authentication or user interaction.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded or issued a fix, organizations should consider implementing network-level protections such as rate limiting or filtering requests to the vulnerable webhook endpoint to mitigate potential resource exhaustion attacks. Monitor for unusual activity targeting the _handle_webhook_request function and apply any future vendor updates promptly.