CVE-2026-14626CWE-404

NousResearch hermes-agent HTTP API run_agent.py AIAgent.run_conversation denial of service

Medium · published July 4, 2026

CVSS v4.0
5.3
EPSS
0%
Percentile
39.8
In the wild
Unconfirmed
What it is

A weakness has been identified in NousResearch hermes-agent up to 2026.4.30. The impacted element is the function AIAgent.run_conversation of the file run_agent.py of the component HTTP API. This manipulation of the argument todos causes denial of service. The attack can be initiated remotely. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

The record
Technical detail
CVSS v4.0
5.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
EPSS
0.00471 · 39.8th percentile
Weakness
CWE-404 · Improper Resource Shutdown or Release
Published
2026-07-04T12:00Z
EPSS history
Timeline
  • 04 JUL 12:00Z
    NousResearch hermes-agent HTTP API run_agent.py AIAgent.run_conversation denial of service
    cvelistv5