Threats tagged 'brew-hermes-agent-cve-2026-111064'

The Hermes agent's aiohttp server did not apply the keepalive timeout during the initial request phase, allowing an attacker to keep an idle connection open indefinitely before sending any data. This vulnerability could lead to resource exhaustion by holding connections open without activity. A fix is available in version 2026.5.16_1. The vendor recommends using a reverse proxy with sensible keepalive limits as a workaround in production environments.