CVE-2026-10224 PUBLISHED

NousResearch hermes-agent Webhook Endpoint feishu.py _handle_webhook_request resource consumption

Assigner: VulDB
Reserved: 31.05.2026 Published: 01.06.2026 Updated: 01.06.2026

A security vulnerability has been detected in NousResearch hermes-agent up to 2026.4.30. This vulnerability affects the function _handle_webhook_request of the file gateway/platforms/feishu.py of the component Webhook Endpoint. Such manipulation leads to resource consumption. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P
CVSS Score: 6.9

Product Status

Vendor NousResearch
Product hermes-agent
Versions
  • Version 2026.4.0 is affected
  • Version 2026.4.1 is affected
  • Version 2026.4.2 is affected
  • Version 2026.4.3 is affected
  • Version 2026.4.4 is affected
  • Version 2026.4.5 is affected
  • Version 2026.4.6 is affected
  • Version 2026.4.7 is affected
  • Version 2026.4.8 is affected
  • Version 2026.4.9 is affected
  • Version 2026.4.10 is affected
  • Version 2026.4.11 is affected
  • Version 2026.4.12 is affected
  • Version 2026.4.13 is affected
  • Version 2026.4.14 is affected
  • Version 2026.4.15 is affected
  • Version 2026.4.16 is affected
  • Version 2026.4.17 is affected
  • Version 2026.4.18 is affected
  • Version 2026.4.19 is affected
  • Version 2026.4.20 is affected
  • Version 2026.4.21 is affected
  • Version 2026.4.22 is affected
  • Version 2026.4.23 is affected
  • Version 2026.4.24 is affected
  • Version 2026.4.25 is affected
  • Version 2026.4.26 is affected
  • Version 2026.4.27 is affected
  • Version 2026.4.28 is affected
  • Version 2026.4.29 is affected
  • Version 2026.4.30 is affected

Credits

  • Eric-j (VulDB User) reporter
  • VulDB CNA Team coordinator

References

Problem Types

  • Resource Consumption CWE
  • Denial of Service CWE