CVE-2026-84288: Denial of Service in NousResearch hermes-agent

This vulnerability in NousResearch hermes-agent up to version 0.18.2 involves the HermesACPAgent.prompt function in the acp_adapter/session.py file of the ACP Prompt Workflow component. Remote attackers can manipulate this function to cause a denial of service condition. The exploit has been publicly disclosed, but there is no indication of active exploitation in the wild. The vendor was notified but has not provided any response or patch. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges or user interaction required, and low impact on availability.

Successful exploitation results in denial of service, potentially disrupting the availability of the hermes-agent service. There is no indication of confidentiality or integrity impact. The medium severity reflects the service disruption risk but limited scope of impact.

No official patch or remediation is currently available from the vendor. Users should monitor vendor communications for updates. In the absence of a fix, consider limiting network exposure of the affected service to trusted sources to reduce risk.