The unauthenticated native-token, native-refresh and password-login endpoints accepted full JSON bodies before enforcing credential checks, because public-route admission and HTTP body-size admission were separate concerns. Tenable held eight 32 MiB concurrent uploads open and recorded memory growth from 721 MiB to 1.08 GiB while the coarse health check…
Inspect the ClaimsCase · DiggingBeagle record
Hermes Agent buffered anonymous authentication requests before enforcing limits
Tenable found that three public Hermes Agent authentication endpoints accepted and parsed oversized JSON bodies before authentication. Concurrent unauthenticated uploads raised dashboard memory consumption in a local test, leaving a denial-of-service risk. The October 9 advisory lists release 0.21.6 as patched.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- patch available
- AI role
- AGAINST AI
Basis and provenance
A controlled concurrent-upload test quantified transient memory growth but not a service crash. The maintainer describes a 64 KiB pre-parser body limit and request-level tests in a merged patch. No independent field exploitation, measured service-wide downtime or complete bundle rollout is established.
Assessed Oct 11, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-HERMES-MEM-PREAUTH · CLM-HERMES-MEM-MEASUREMENT · CLM-HERMES-MEM-EXACT-FIX · Tenable TRA-2026-63: Hermes Agent Pre-Authentication Memory Exhaustion · Hermes Agent pull request 133370: public authentication body limit · NousResearch Hermes Agent v0.21.6 release and security fixes
At a glance
Public authentication endpoints are resource-exhaustion surfaces even when their handler will reject the credentials.
Read the implicationsThe advisory does not show an outage or exploitation against an unrelated live organization. Availability impact depends on deployment memory limits and ingress protections.
Limits and uncertaintyFull account
The unauthenticated native-token, native-refresh and password-login endpoints accepted full JSON bodies before enforcing credential checks, because public-route admission and HTTP body-size admission were separate concerns. Tenable held eight 32 MiB concurrent uploads open and recorded memory growth from 721 MiB to 1.08 GiB while the coarse health check still said overall=ok. This is a researcher-measured memory-pressure condition, not a documented service outage. The maintainer merged a pure-ASGI 64 KiB bound on October 5 that rejects oversized declared Content-Length before reading and cuts off chunked or underdeclared bodies as they arrive. Its tests reported 413 responses before normal parsing, without changing authenticated uploads or WebSockets. The fix was included in October 8 v0.21.6 Docker/CLI distribution, while the release said Desktop and Termux packages had not yet been updated.
Mechanism and trust boundary
- 01
Anonymous requests enter public authentication routes
The routes must accept unauthenticated traffic but still need independent resource admission.
Boundary: network / public auth path
- 02
HTTP bodies are buffered and parsed before rejection
Without a pre-parser size limit, the app allocates memory for payloads it will ultimately reject.
Boundary: untrusted bytes / memory allocation
- 03
Concurrent requests amplify memory pressure
Eight held-open uploads measurably raised process memory in Tenable's experiment.
Boundary: per-request allocation / service availability
Timeline
- Sep 3, 2026Event type unspecified
Researcher starts disclosure
Tenable reports first contact.
- Sep 3, 2026notification
Vendor notified
- Oct 5, 2026Event type unspecified
Fix noted
Tenable records the memory-limit repair in PR #133370.
- Oct 5, 2026patch
Fix date recorded
- Oct 9, 2026Event type unspecified
TRA-2026-63 published
Pre-authentication memory-exhaustion vulnerability is publicly disclosed.
- Oct 9, 2026disclosure
Public disclosure
Claims & evidence
CLM-HERMES-MEM-PATCHTenable states the issue was fixed on October 5 in PR #133370 and identifies Hermes Agent 0.21.6 as the patched release in its October 9 advisory.supported
Basis: reported finding
- supportsTenable TRA-2026-63: Hermes Agent Pre-Authentication Memory Exhaustionprimary disclosure
Solution; Disclosure Timeline October 05 fixed on PR #133370; Affected Products; Advisory Timeline
CLM-HERMES-MEM-PREAUTHHermes Agent publicly accessible native-token, native-refresh and password-login routes read and parsed full JSON request bodies without application-level HTTP size bounds before an authentication decision.supported
Basis: reported finding
- supportsTenable TRA-2026-63: Hermes Agent Pre-Authentication Memory Exhaustionprimary disclosure
Synopsis: named endpoints, _GATE_PUBLIC_PREFIXES and FastAPI/Starlette/Uvicorn request buffering
CLM-HERMES-MEM-EXACT-FIXNousResearch merged PR #133370 on October 5. Its pure-ASGI middleware caps public /auth/ POST bodies at 64 KiB before normal JSON buffering, rejects excessive Content-Length immediately and counts actual bytes to cut off chunked or understated bodies; authenticated routes, uploads and WebSockets are left unchanged.supported
Basis: reported finding
- supportsHermes Agent pull request 133370: public authentication body limitpatch commit artifact
Pull request #133370: What does this PR do; Changes Made; How to Test; merge October 5
CLM-HERMES-MEM-MEASUREMENTDuring Tenable testing, eight concurrent 32 MiB anonymous uploads held open for fifteen seconds raised the dashboard process from 721 MiB to 1.08 GiB, while the health endpoint still reported overall=ok.supported
Basis: reported finding
- supportsTenable TRA-2026-63: Hermes Agent Pre-Authentication Memory Exhaustionprimary disclosure
Synopsis: eight concurrent 32 MiB uploads, process memory and /api/status results
Implications
Public authentication endpoints are resource-exhaustion surfaces even when their handler will reject the credentials.
Controls and mitigations
- Upgrade Hermes Agent to 0.21.6 or later.
- Enforce total HTTP body size, parser limits, connection timeouts and concurrent upload limits before accepting payloads.
- Monitor actual process memory and ingress pressure in addition to a basic overall=ok health check.
Unknowns and contradictions
- The advisory does not show an outage or exploitation against an unrelated live organization.
- Availability impact depends on deployment memory limits and ingress protections.
Sources and citation
Material revision history
- Oct 10, 2026 · Published version · first publication · revision 120