CVE-2026-84289
Medium · 4.3CVSS
4.3
EPSS
0.5%
Published
Sep 1, 2026
CISA due date
—
The record
A vulnerability was found in NousResearch hermes-agent up to 0.18.2. This vulnerability affects the function list_tools of the file tools/mcp_tool.py of the component MCP Tool. Performing a manipulation results in uncontrolled memory allocation. It is possible to initiate the attack remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-113795 pypdf is a free and open-source pure-python PDF library. CWE-400
- CVE-2026-83400 Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise… CWE-400
- CVE-2026-112400 Pillow is a Python imaging library. CWE-400
- CVE-2026-111766 markdown-it is a Markdown parser. CWE-400
- CVE-2026-111759 markdown-it is a Markdown parser. CWE-400
- CVE-2025-52290 A NULL pointer dereference in the avpriv_h264_has_num_reorder_frames function of Ffmpeg… CWE-400
- CVE-2026-111066 AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. CWE-400
- CVE-2026-59951 The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context… CWE-400