CVE-2026-108859 in mcp-go
Summary
by MITRE • 10/11/2026
mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that allows remote unauthenticated attackers to exhaust memory by sending oversized POST bodies. Attackers can send arbitrarily large or many concurrent POST requests, read fully via io.ReadAll before validation, to degrade or OOM-kill the server process.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/11/2026
The mcp-go library version 1.2.1 and earlier contains a critical denial of service vulnerability within its StreamableHTTPServer implementation, specifically in the ServeHTTP method. This flaw stems from an improper handling of incoming HTTP POST requests where the system prioritizes reading the entire request body into memory before performing any validation checks on the content or size. By design, many web servers attempt to read full payloads to facilitate parsing and processing; however, failing to impose strict limits on this operation creates a significant resource exhaustion vector for remote unauthenticated attackers.
The technical root cause of this vulnerability lies in the use of io.ReadAll without prior length validation. When an attacker sends POST requests with arbitrarily large bodies or initiates many concurrent connections carrying substantial payloads, the server allocates memory proportional to the size of each request body. Since these reads occur before any authentication or payload inspection logic is triggered, there are no safeguards to reject oversized inputs early in the request lifecycle. This architectural oversight allows malicious actors to systematically consume available system RAM by flooding the service with large data streams.
The operational impact of this vulnerability is severe, leading directly to resource exhaustion and potential server crashes. As memory consumption increases due to the accumulation of unread or partially processed large payloads, the application may experience significant performance degradation characterized by high latency and unresponsiveness for legitimate users. In more extreme scenarios where sufficient resources are not available to handle the load, the operating system's out-of-memory killer mechanism may terminate the server process entirely, resulting in a complete denial of service until the service is manually restarted or resource limits are adjusted.
This vulnerability aligns with CWE-400, which describes uncontrolled resource consumption, and specifically relates to improper input validation that allows for memory exhaustion attacks. From an offensive security perspective, this behavior can be mapped to ATT&CK technique T1498, Network Denial of Service, as it involves overwhelming a target system's resources through sustained or volumetric attack patterns rather than exploiting logic flaws in application functionality.
To mitigate this risk, developers must implement strict input size limits at the HTTP server level before any body reading operations take place. This can be achieved by configuring max request headers and using io.LimitReader to cap the amount of data read from the request body during parsing. Additionally, implementing rate limiting and connection throttling mechanisms will help prevent a single source or multiple sources from overwhelming the server with concurrent requests. Upgrading to patched versions of mcp-go that address this issue by validating payload sizes prior to full memory allocation is essential for restoring secure operation.