MediumVulnerability
CVE-2026-8319: aiwaves-cn agents resource consumption via memory recall function
- Source
- NVD(opens in a new tab)
- Identifier
- CVE-2026-8319
- Published
- Record updated
- Affected
- ai-agents <= 0.0.52
- Fixed in
- No fixed version was stated when the source was last read.
- Known exploitation
- Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
- EPSS
- 0.6%
Summary
A weakness in the recall_relevant_memories_to_working_memory function, in core/cat/looking_glass/stray_cat.py of the cheshire_cat_core component of aiwaves-cn agents, affects versions up to e8c4e3c2d19739d3dff59e577d1c97090cc15f59. Manipulating the function causes resource consumption and can be exploited remotely. A public exploit exists, and the project was informed through an issue report but has not yet responded.
Mitigation
The source does not state a fix yet. Check the original advisory for updates.
Related items
- MediumCVE-2026-108748: Quarkus LangChain4j memory exhaustion in chat-scopes WebSocketSimilar attack · NVD/CVE Database
- HighHermes Agent - Pre-Authentication Disk ConsumptionSimilar attack · Tenable Research Advisories
- MediumHermes Agent - Pre-Authentication Memory ExhaustionSimilar attack · Tenable Research Advisories
- MediumGHSA-v36g-jcw9-x7cw: Pydantic AI: Excessive resource use when local web fetching converts nested HTMLSimilar attack · GitHub Advisory Database
- MediumGHSA-v2xh-2vp8-57h8: Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrlSimilar attack · GitHub Advisory Database