Description

A vulnerability was found in NousResearch hermes-agent up to 0.18.2. This vulnerability affects the function list_tools of the file tools/mcp_tool.py of the component MCP Tool. Performing a manipulation results in uncontrolled memory allocation. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-09-01T22:17:18.813Z",
  "pubdate": "2026-09-01T22:17:18.813Z",
  "executiveSummary": "A critical memory exhaustion vulnerability has been identified in the NousResearch hermes-agent, affecting versions up to 0.18.2. The flaw resides within the list_tools function of the MCP Tool component. An unauthenticated remote attacker can trigger uncontrolled memory allocation, leading to a denial-of-service condition.\nThe vulnerability allows an adversary to exhaust system resources by submitting maliciously crafted requests that force the application to allocate disproportionate amounts of memory. Because the flaw is reachable remotely, the attack vector does not require prior authentication or elevated privileges, making it a significant risk to service availability.\nGiven that exploit code has been publicly disclosed and the vendor has not responded to disclosure attempts, systems running affected versions are currently vulnerable to active exploitation. Organizations should prioritize implementing defensive measures to restrict access to the MCP Tool interface or apply resource management constraints to the agent process.",
  "technicalDetails": "The vulnerability is located in the list_tools function within the file tools/mcp_tool.py. The root cause is an insecure handling of input during the retrieval or parsing of tool definitions, which fails to implement appropriate bounds checking or limits on the volume of data processed during the tool enumeration phase.\nThe exploitation flow begins when an attacker transmits a crafted payload to the hermes-agent interface that interacts with the MCP Tool subsystem. Upon invoking list_tools, the function attempts to process the attacker-supplied data structure. Due to the lack of input sanitization or size constraints, the application performs an uncontrolled allocation of memory on the heap. By repeatedly sending such requests, or by sending a single payload designed to trigger massive memory growth, the attacker forces the process to consume available system RAM.\nThis behavior results in immediate resource exhaustion, leading to an Out-of-Memory (OOM) condition. If the process is terminated by the operating system's OOM killer, the agent becomes unavailable, causing a denial-of-service. In environments where the agent process shares resources with other services, this memory pressure may degrade the performance or stability of the entire host system.\nThe component affected is the MCP Tool interface. Exploitation requires no prior authentication and can be performed remotely via the network protocols supported by the hermes-agent. The vulnerability is triggered during the standard execution path of the list_tools function, meaning any automated or manual interaction that forces the agent to list available tools is susceptible to the attack. Post-exploitation, the primary impact is total service disruption; there is no documented evidence that this specific memory exhaustion leads to arbitrary code execution, though it serves as a highly effective mechanism to crash target infrastructure."
}