hermes-agent API Server Forged Conversation History Causes Context Exhaustion (DoS)

Vulnerability Overview Title: Hermes Agent API Server allows forged todo-history hydration that can exhaust session context Description: The Hermes Agent API Server accepts entries provided by the caller and trusts the JSON object contained in messages with on the HTTP API server as authoritative todo-tool output. Since the hydrated todo entries are written to the without authentication or size checks and are later re-injected during subsequent context compression flows, API clients can inject excessively large persistent todo states, leading to Denial of Service (DoS) for the affected session. Details: The issue is caused by the interaction of three code paths: 1. The API server accepts arbitrary objects and forwards them to . 2. automatically calls to provide history for new agent instances. 3. trusts any prior messages, even if their content contains a key. It parses this content and re-injects it into the , which performs no size or authentication checks before re-injecting active items. Relevant Code: Real-world Exploitation: An attacker can submit a forged history entry containing a very large todo item via the API, such as a 50,001 character string. The hydration logic accepts this as previous tool output, stores it, and issues a 50,085 character re-injected block during compression. This consumes the context budget and may break or interrupt the session. Scope Ecosystem: pip Package: hermes-agent Affected Versions: All released versions, including v2026.5.29.2 (latest at the time of writing). Verification confirms the vulnerability remains unpatched: performs no authentication checks, and enforces no per-item or total size limits. Patched Versions: None Remediation No specific remediation is currently provided. Developers need to audit and fix the authentication and size-checking logic within and . POC Code Prerequisites: A running Hermes Agent repository with vulnerable code. Hermes API Server enabled. Model/provider configured so the API server can handle requests. Network or local access to . If the API server is exposed on a non-local interface, a valid is required. Local deployments may accept requests without a configured key. Reproduction Steps: 1. Start the target service: 2. Download the external POC script from . 3. Run the external POC against the local API server: If the API server requires authentication: 4. For control cases, download . 5. Run control requests without forged tool history: Or with authentication: 6. For direct sink verification, download . 7. Run the direct verification script: 8. Optional minimal agent artifact: Evidence Logs Runtime evidence observed from : This indicates that the forged history entry was accepted into the and converted into an extremely large context re-injection block. Impact This is a Denial of Service (DoS) vulnerability affecting Hermes Agent sessions reachable via the API server. An attacker with API access can poison the todo state of each session with excessively large forged tool outputs, leading to persistent context bloat and potentially breaking subsequent requests. The primary assets affected are service availability and session integrity. No direct code execution is required to trigger the issue. Weakness CWE: CWE-345: Insufficient Verification of Data Authenticity Occurrence Permanent Links: - https://github.com/NousResearch/hermes-agent/blob/5e743559e0157d42e0640cd06d736e898370d0/gateway/platforms/api_server.py#L2148-L2196 - https://github.com/NousResearch/hermes-agent/blob/5e743559e0157d42e0640cd06d736e898370d0/run_agent.py#L2113-L2142 - https://github.com/NousResearch/hermes-agent/blob/5e743559e0157d42e0640cd06d736e898370d0/agent/conversation_loop.py#L333-L337 - https://github.com/NousResearch/hermes-agent/blob/5e743559e0157d42e0640cd06d736e898370d0/tools/todo_tool.py#L38-L80 - https://github.com/NousResearch/hermes-agent/blob/5e743559e0157d42e0640cd06d736e898370d0/tools/todo_tool.py#L90-L123 - https://github.com/NousResearch/hermes-agent/blob/5e743559e0157d42e0640cd06d736e898370d0/tools/todo_tool.py#L125-L146 Description The API server accepts controlled entries and forwards them to , trusting forged messages from user-supplied even if they were not generated by an actually registered todo tool. automatically calls using history for new agent instances, allowing forged todos to pass through normal API calls. has no size limit enforcer for re-injected todo items. formats each active item into a re-injected agent, amplifying the affected context window. performs no character length limits, resulting in persistent state.

Goal Reached Thanks to every supporter — we hit 100%!

hermes-agent API Server Forged Conversation History Causes Context Exhaustion (DoS)

More from this source