What is CVE-2026-49955?

CVE-2026-49955 is a medium-severity vulnerability in Nesquena Hermes-Webui, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 5.3/10. Published 2026-06-09.

How severe is CVE-2026-49955?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Resource exhaustion in Nesquena Hermes-Webui

CVE-2026-49955

Hermes WebUI before version 0.51.270 contains a resource exhaustion vulnerability that allows unauthenticated remote attackers to degrade service availability by repeatedly calling the passkey options endpoint without completing assertion. Attackers can send unlimited POST requests to the authentication endpoint, causing unbounded growth of the challenge store file and excessive CPU and disk I/O through repeated JSON file rewrites.

EPSS: 0.006 (46.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L.

Affected products

Nesquena Hermes-webui — versions 0

Weakness classification (CWE)

CWE-770 — Allocation of Resources Without Limits or Throttling

References

disclosure@vulncheck.com (patch)
disclosure@vulncheck.com (issue-tracking, technical-description)
disclosure@vulncheck.com (issue-tracking)
disclosure@vulncheck.com (release-notes)
disclosure@vulncheck.com (third-party-advisory)

Frequently asked questions

What is CVE-2026-49955?: CVE-2026-49955 is a medium-severity vulnerability in Nesquena Hermes-Webui, classified under Allocation of Resources Without Limits or Throttling. CVSS score: 5.3/10. Published 2026-06-09.
How severe is CVE-2026-49955?: Medium severity. CVSS v3 base score is 5.3 out of 10.