Evidence record / hermes-agent
A dated record of one change, kept so the writing that cites it can be checked. Compiled from the sources listed below by the research run, not written for reading. The judgment lives in the issues that cite it, below.
2026-10-24-hermes-agent-aiohttp-multipart-resource-exhaustion-is-patched-in-messaging-dependency-pins
Aiohttp multipart resource exhaustion is patched in messaging dependency pins. Messaging, Slack, Matrix, SMS and Teams exact pins move to aiohttp 3.14.5. CVE-2026-111066, published to the global advisory database on 2026-10-20, lets crafted multipart requests exhaust file descriptors when a server handler calls Request.post(). The affected range is >=2.0.0,<3.14.4; 3.14.4 is the first fix. No reachable Hermes handler exploit was established.
Channel: tagged-release. Half: defect. Date: 2026-10-23.
Operator consequence: Upgrade installed extras and inspect resolved versions. The dependency repair is actionable without claiming every Hermes messaging deployment is remotely exploitable.
Receipt
Finding metadata
Run: 2026-10-24-weekly-digest-2026-10-13_2026-10-24-frontier-v0
Finding ID: 2026-10-24-hermes-agent-aiohttp-multipart-resource-exhaustion-is-patched-in-messaging-dependency-pins
Profile citations
- Hermes Agent / claim / aiohttp-multipart-remediation
Source links
Primary links, including exact changelog lines when available.
- commit2026-10-24-hermes-agent-aiohttp-multipart-resource-exhaustion-is-patched-in-messaging-dependency-pinsgithub.com/NousResearch/hermes-agent/commit/33836d505497a964bff989a916174b05e358362atagged commit file2026-10-24-hermes-agent-aiohttp-multipart-resource-exhaustion-is-patched-in-messaging-dependency-pinsNousResearch/hermes-agent / pyproject.tomlofficial docs2026-10-24-hermes-agent-aiohttp-multipart-resource-exhaustion-is-patched-in-messaging-dependency-pinsgithub.com/advisories/GHSA-9xw5-w5jj-pvcg
Versioned source: run artifact