CVE-2026-108859CWE-770denial-of-service

CVE-2026-108859

High · published October 11, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
45.0
In the wild
Unconfirmed
What it is

mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that allows remote unauthenticated attackers to exhaust memory by sending oversized POST bodies. Attackers can send arbitrarily large or many concurrent POST requests, read fully via io.ReadAll before validation, to degrade or OOM-kill the server process.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
8.7 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00545 · 45.0th percentile
Weakness
CWE-770 · Allocation of Resources Without Limits or Throttling
Published
2026-10-11T18:17Z
References (4)
https://github.com/mark3labs/mcp-go · [email protected]https://github.com/mark3labs/mcp-go/blob/90d247ed8d45cbb7d71d9a95e112789b78760443/server/streamable_http.go#L405-L411 · [email protected]https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/mark3labs-mcp-go-streamable-http-unbounded-body · [email protected]https://www.vulncheck.com/advisories/mcp-go-through-1.2.1-denial-of-service-via-unbounded-post-body-buffering · [email protected]
EPSS history
Timeline
  • 13 OCT 03:28Z
    EPSS moved — → 1%
    epss
  • 11 OCT 13:26Z
    mcp-go through 1.2.1 Denial of Service via Unbounded POST Body Buffering
    cvelistv5
  • 11 OCT 13:26Z
    mcp-go through 1.2.1 Denial of Service via Unbounded POST Body Buffering
    cvelistv5