CVE-2026-55205

Executive Summary

CVE-2026-55205 is a critical resource exhaustion vulnerability in the Hermes WebUI application, affecting versions prior to 0.51.468. The flaw resides in the unauthenticated /api/onboarding/oauth/start endpoint, allowing an attacker to trigger unbounded accumulation of in-memory flow state and daemon threads. By sending repeated or concurrent HTTP POST requests, an attacker can exhaust server memory and thread resources, leading to a denial-of-service (DoS) condition. This vulnerability also forces the server to generate repeated outbound device-code requests to upstream OAuth providers, potentially causing resource abuse on external services.

Supply Chain & Package Security

Hermes WebUI is a self-hosted web interface. There is no NPM, PyPI, Go, or Ruby package associated with this vulnerability. The supply chain risk is limited to the application's own dependencies and deployment environment.

CVSS Breakdown & Threat Level

While no official CVSS vector is provided, based on the description, a reasonable assessment is:

• Attack Vector (AV): Network (N) – The endpoint is accessible over the network.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerability affects only the vulnerable component.
• Confidentiality (C): None (N) – No data exposure.
• Integrity (I): None (N) – No data modification.
• Availability (A): High (H) – Complete loss of service.

Estimated CVSS Score: 7.5 (High)

Threat Level: High. The vulnerability is easy to exploit, requires no authentication, and can cause a complete denial of service.

Deep Dive & Mechanics

The vulnerability is a classic resource exhaustion (CWE-400) issue. The /api/onboarding/oauth/start endpoint is designed to initiate an OAuth device-code flow. When a request is received, the server:

1. Creates an in-memory state object to track the OAuth flow.
2. Spawns a daemon thread to handle the outbound request to the upstream OAuth provider.
3. Returns a response to the client.

The flaw is that the server does not enforce any rate limiting or resource caps on this endpoint. An attacker can send a high volume of requests, causing:

• Memory Exhaustion: Each request creates a new state object that is never cleaned up until the flow completes or times out. With enough concurrent requests, the server's heap memory fills up, leading to OutOfMemoryErrors.
• Thread Exhaustion: Each request spawns a new daemon thread. The server's thread pool is finite; once exhausted, the server cannot handle any new requests, including legitimate ones.
• Upstream Abuse: Each request triggers an outbound HTTP request to the upstream OAuth provider. This can lead to rate limiting or blacklisting of the server's IP address by the OAuth provider.

The attack does not require any authentication, making it trivially exploitable from any network-accessible location.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# Vulnerable endpoint handler
@app.route('/api/onboarding/oauth/start', methods=['POST'])
def start_oauth():
    state = create_oauth_state()  # In-memory state
    thread = threading.Thread(target=send_device_code_request, args=(state,))
    thread.daemon = True
    thread.start()
    return jsonify({"state_id": state.id}), 200

Patched Code (Conceptual):

# Patched endpoint handler with rate limiting and resource management
from flask_limiter import Limiter
limiter = Limiter(key_func=lambda: request.remote_addr)

@app.route('/api/onboarding/oauth/start', methods=['POST'])
@limiter.limit("5 per minute")  # Rate limit per IP
def start_oauth():
    # Check current thread count
    if threading.active_count() > MAX_THREADS:
        return jsonify({"error": "Server busy"}), 503
    state = create_oauth_state()
    # Use a thread pool with a maximum size
    executor.submit(send_device_code_request, state)
    return jsonify({"state_id": state.id}), 200

The patch introduces rate limiting and a thread pool with a maximum size, preventing unbounded resource consumption.

Exploitation & Lab Setup

Red Team

Objective: Cause a denial of service on the Hermes WebUI server.

Prerequisites:

• Network access to the target server.
• The target is running Hermes WebUI version < 0.51.468.

Exploitation Steps:

1. Identify the target: Use Shodan or manual scanning to find Hermes WebUI instances.

2. Send concurrent requests: Use a tool like curl in a loop or a script to send many POST requests to the vulnerable endpoint.

   #!/bin/bash
   TARGET="http://target-ip:port"
   for i in {1..1000}; do
     curl -X POST "$TARGET/api/onboarding/oauth/start" &
   done
   wait
   

3. Monitor the server: The server will become unresponsive. Legitimate requests will time out or return errors.

Advanced Exploitation:

• Use a distributed botnet to amplify the attack.
• Combine with other DoS techniques (e.g., slow loris) for maximum impact.

Blue Team

Objective: Detect and mitigate the attack.

Detection Steps:

1. Monitor endpoint access: Look for a high volume of POST requests to /api/onboarding/oauth/start from a single or multiple IPs.
2. Check server metrics: Monitor memory usage, thread count, and response times. A sudden spike indicates an attack.
3. Analyze logs: Look for repeated 200 responses to the vulnerable endpoint followed by 503 or timeout errors.

Mitigation Steps:

1. Apply the patch: Upgrade to version 0.51.468 or later.
2. Implement rate limiting: Use a reverse proxy (e.g., Nginx) to limit requests per IP.

   limit_req_zone $binary_remote_addr zone=oauth:10m rate=5r/m;
   server {
       location /api/onboarding/oauth/start {
           limit_req zone=oauth burst=10 nodelay;
           proxy_pass http://backend;
       }
   }
   

3. Use a Web Application Firewall (WAF): Block or rate-limit requests to the vulnerable endpoint.
4. Monitor upstream OAuth providers: Check for unusual outbound traffic patterns.

Indicators of Compromise (IOCs)

• Network IOCs:
  • High volume of HTTP POST requests to /api/onboarding/oauth/start.
  • Repeated 200 responses followed by 503 or connection timeouts.
  • Unusual outbound traffic to OAuth provider endpoints (e.g., https://oauth.provider.com/device/code).
• System IOCs:
  • High memory usage (near 100%).
  • High thread count (thousands of daemon threads).
  • Application logs showing OutOfMemoryError or thread pool exhaustion.
• File IOCs:
  • Heap dump files (if automatic dump is enabled).
  • Thread dump files showing many send_device_code_request threads.

Detection Engineering

YARA Rule

rule Hermes_WebUI_Resource_Exhaustion {
    meta:
        description = "Detects resource exhaustion attempts against Hermes WebUI /api/onboarding/oauth/start"
        author = "Valters IT"
        date = "2026-01-01"
        cve = "CVE-2026-55205"
    strings:
        $endpoint = "/api/onboarding/oauth/start"
        $method = "POST"
    condition:
        #endpoint > 100 and $method
}

Sigma Rule

title: Hermes WebUI Resource Exhaustion Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects a high volume of POST requests to the vulnerable endpoint
author: Valters IT
date: 2026/01/01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/onboarding/oauth/start'
    condition: selection | count() by src_ip > 100 within 1m
falsepositives:
    - Legitimate high traffic from many users
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-55205 Hermes WebUI Resource Exhaustion"; flow:to_server; content:"POST"; http_method; content:"/api/onboarding/oauth/start"; http_uri; threshold: type both, track by_src, count 100, seconds 60; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update Hermes WebUI to version 0.51.468 or later.
2. Rate Limiting: Implement rate limiting on the vulnerable endpoint using a reverse proxy or WAF.
3. Monitor: Enable logging and monitoring for the endpoint.

Long-term Measures:

1. Code Review: Conduct a security review of all unauthenticated endpoints.
2. Resource Limits: Implement thread pools and memory limits in the application.
3. Input Validation: Validate and sanitize all incoming requests.
4. Network Segmentation: Place the Hermes WebUI behind a firewall and restrict access to trusted IPs.

Workarounds (if patching is not possible):

• Block the endpoint at the firewall or reverse proxy level.
• Disable the OAuth onboarding feature if not needed.

Valters IT
Securing Digital Frontiers