Hermes Agent - Pre-Authentication Memory Exhaustion

T1Covered by 1 source · first reported by Tenable Research at 09 Oct, 15:07 UTC

Hermes Agent - Pre-Authentication Memory Exhaustion In Hermes Agent the dashboard's public authentication routes (/auth/native/token, /auth/native/refresh, and /auth/password-login) read and parse the entire JSON request body before any authentication check, with no application-level size limit…

security

Sources

• T1Hermes Agent - Pre-Authentication Memory ExhaustionTenable Research09 Oct, 15:07