Tenable TRA-2026-63: Hermes Agent Pre-Authentication Memory Exhaustion

Evidence record

Researcher disclosure of unauthenticated oversized body buffering by Hermes Agent dashboard public authentication routes. Includes measured process-memory increase and remediation in 0.21.6.

Read the original source ↗

Claim-level citations (3)

• supportsHermes Agent buffered anonymous authentication requests before enforcing limits: Tenable states the issue was fixed on October 5 in PR #133370 and identifies Hermes Agent 0.21.6 as the patched release in its October 9 advisory.

  Solution; Disclosure Timeline October 05 fixed on PR #133370; Affected Products; Advisory Timeline

• supportsHermes Agent buffered anonymous authentication requests before enforcing limits: Hermes Agent publicly accessible native-token, native-refresh and password-login routes read and parsed full JSON request bodies without application-level HTTP size bounds before an authentication decision.

  Synopsis: named endpoints, _GATE_PUBLIC_PREFIXES and FastAPI/Starlette/Uvicorn request buffering

• supportsHermes Agent buffered anonymous authentication requests before enforcing limits: During Tenable testing, eight concurrent 32 MiB anonymous uploads held open for fifteen seconds raised the dashboard process from 721 MiB to 1.08 GiB, while the health endpoint still reported overall=ok.

  Synopsis: eight concurrent 32 MiB uploads, process memory and /api/status results