CVE-2026-84886
Received Received - Intake

Resource Consumption in Simular-AI Agent-S OCR API

Publication date: 2026-09-03

Last updated on: 2026-09-03

Assigner: VulDB

Description
A vulnerability was determined in simular-ai Agent-S up to 0.3.2. Affected by this vulnerability is the function ImageData of the file gui_agents/s1/utils/ocr_server.py of the component OCR HTTP API. Executing a manipulation of the argument img_bytes can lead to resource consumption. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-03
Last Modified
2026-09-03
Generated
2026-09-03
AI Q&A
2026-09-03
EPSS Evaluated
N/A
NVD
CVE-2026-84886
EUVD
EUVD-2026-70284

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
simular-ai agent-s to 0.3.2 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-404 The product does not release or incorrectly releases a resource before it is made available for re-use.
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a denial-of-service (DoS) vulnerability in simular-ai Agent-S up to version 0.3.2. It affects the ImageData function in gui_agents/s1/utils/ocr_server.py. The issue occurs when the img_bytes argument in the OCR HTTP API is manipulated to consume excessive server resources, potentially crashing the service.

Detection Guidance

Monitor for unusually large HTTP requests to the /ocr/ endpoint in simular-ai Agent-S. Check for requests with img_bytes fields exceeding normal sizes. Use network monitoring tools like tcpdump or Wireshark to capture and analyze traffic to this endpoint. Inspect server logs for crashes or high resource usage during image processing requests.

Impact Analysis

An attacker could send a large request with a base64-encoded image payload, causing the server to exhaust memory or CPU resources. This could crash the OCR service, making it unavailable. In a Docker environment, it may trigger an OOMKilled error, halting the service.

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that disrupt service availability. GDPR requires data protection measures, including availability of processing systems, which could be compromised. HIPAA mandates safeguards against unauthorized resource consumption that could affect system integrity and availability.

Mitigation Strategies

Immediately restrict access to the /ocr/ endpoint by implementing authentication. Enforce strict request size limits on the HTTP server or application layer. Add validation to cap the img_bytes field size before processing. Configure memory limits and timeouts for the OCR service container or process.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84886. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart