CVE-2026-84287: Denial of Service in NousResearch hermes-agent

This vulnerability in NousResearch hermes-agent 0.18.0 involves a flaw in the Session Chat Interface component, specifically in the file gateway/platforms/api_server.py. The issue allows a remote attacker to cause a denial of service condition. The attack requires no user interaction and can be performed with low privileges. Exploit code has been made public, increasing the risk of exploitation. The vendor has not provided any response or fix, and no official remediation guidance is available.

Successful exploitation results in denial of service, potentially disrupting the availability of the affected hermes-agent service. Since the attack can be performed remotely without authentication or user interaction, it could be leveraged to interrupt service operations. There is no indication of further impact such as data disclosure or privilege escalation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no patch is available, users should monitor for updates from NousResearch. Until a fix is provided, consider limiting network exposure of the affected service to trusted sources only to reduce risk.