Tools AI Risk Radar ai-incident-0184
Incident record
Hermes Agent fixes memory exhaustion before authentication
- Severity
- Medium
- Status
- Patched
- Type
- Infra Vuln
- Target
- Hermes Agent before 0.21.6
- Actor
- researcher
What happened
Public authentication handlers buffered unrestricted request bodies in memory. Large requests could exhaust memory and disrupt the service.
Tenable advisory TRA-2026-63 rates the flaw Medium. Version 0.21.6 fixes it. This is a separate resource-exhaustion issue from the provider-string logging flaw.
Sources
- Primary disclosurewww.tenable.com/security/research/tra-2026-63
- Supporting primary sourcegithub.com/NousResearch/hermes-agent/releases/tag/v0.21.6
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 13 October 2026