CVE-2026-108859
mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that allows remote unauthenticated attacke
CVSS
7.5
Alto
EPSS
0.5%
p44
KEV
—
Exploit Today
13
0-100
Publicado: 11 oct 2026 · Última mod.: 11 oct 2026 · CWE-770
0.5%EPSS · 30 días0.5%
2026-10-122026-10-13
mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that allows remote unauthenticated attackers to exhaust memory by sending oversized POST bodies. Attackers can send arbitrarily large or many concurrent POST requests, read fully via io.ReadAll before validation, to degrade or OOM-kill the server process.
- github.comhttps://github.com/mark3labs/mcp-go
- github.comhttps://github.com/mark3labs/mcp-go/blob/90d247ed8d45cbb7d71d9a95e112789b78760443/server/streamable_http.go#L405-L411
- hackmd.iohttps://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/mark3labs-mcp-go-streamable-http-unbounded-body
- www.vulncheck.comhttps://www.vulncheck.com/advisories/mcp-go-through-1.2.1-denial-of-service-via-unbounded-post-body-buffering
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-880845.3 MED—
——0Allocation of resources without limits or throttling in SQL Server allows an authorized attacker to deny service over a network.16hCVE-2026-969597.5 ALT—
——0Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network.19hCVE-2026-963005.9 MED—
——0Uncontrolled resource consumption in RPC Endpoint Mapper Service allows an unauthorized attacker to deny service over a network.19hCVE-2026-962367.5 ALT—
——0Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.19hCVE-2026-853217.5 ALT—
——0Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.18hCVE-2026-853197.5 ALT—
——0Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.18h