CVE-2026-10224CWE-400CWE-404

NousResearch hermes-agent Webhook Endpoint feishu.py _handle_webhook_request resource consumption

Medium · published June 1, 2026

CVSS v4.0
6.9
EPSS
0%
Percentile
30.0
In the wild
Unconfirmed
What it is

A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.30. This vulnerability affects the function _handle_webhook_request of the file gateway/platforms/feishu.py of the component Webhook Endpoint. Such manipulation leads to resource consumption. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00372 · 30.0th percentile
Weaknesses
CWE-400 · Uncontrolled Resource Consumption; CWE-404 · Improper Resource Shutdown or Release
Published
2026-06-01T04:30Z
EPSS history
Timeline
  • 01 JUN 04:30Z
    NousResearch hermes-agent Webhook Endpoint feishu.py _handle_webhook_request resource consumption
    cvelistv5