THREATOPS

THREAT OPS › Threat News › [NVD] CVE-2026-55205 (MEDIUM 5.3) — Hermes WebUI before 0.51.468 contains a resource exhaustion vulnerability in the unauthenticated POST /api/onboarding/oauth/start endpoint that allows unbounded accumulation of in-memory flow state and daemon threads. Attackers can send repeated or concurrent requests to exhaust

[NVD] CVE-2026-55205 (MEDIUM 5.3) — Hermes WebUI before 0.51.468 contains a resource exhaustion vulnerability in the unauthenticated POST /api/onboarding/oauth/start endpoint that allows unbounded accumulation of in-memory flow state and daemon threads. Attackers can send repeated or concurrent requests to exhaust

lownvdPublished 2026-06-18

CVE-2026-55205 CVSS: 5.3 MEDIUM Published: 2026-06-18T17:16:34.767

Hermes WebUI before 0.51.468 contains a resource exhaustion vulnerability in the unauthenticated POST /api/onboarding/oauth/start endpoint that allows unbounded accumulation of in-memory flow state and daemon threads. Attackers can send repeated or concurrent requests to exhaust server memory and thread resources, potentially trig

Indicators of compromise

CVE-2026-55205cve

Original source: https://nvd.nist.gov/vuln/detail/CVE-2026-55205