CVE-2026-108395

Awaiting Analysis Awaiting Analysis - Queue

Memory Exhaustion in Model Context Protocol Java SDK

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through 1.1.3 in io.modelcontextprotocol.sdk:mcp-core, and from mcp-core 2.0.0-M1 through 2.0.0, the Servlet-based SSE, Streamable HTTP, and Stateless server transports read an HTTP request body into memory without enforcing a maximum size. An unauthenticated remote client able to reach an affected transport can stream an arbitrarily large POST body, including with chunked transfer encoding, until the Java process exhausts its heap and becomes unavailable. Authentication, Origin or Host validation, or an upstream request-size limit can reject the request before the vulnerable read. The maintained mcp-core lines are fixed in versions 0.18.4, 1.1.4, and 2.0.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-108395

EUVD

EUVD-2026-101503

Affected Vendors & Products

Vendor	Product	Version / Range
modelcontextprotocol	io.modelcontextprotocol.sdk:mcp	>= 0.8.0, < 0.13.0
modelcontextprotocol	io.modelcontextprotocol.sdk:mcp-core	>= 0.13.0, < 0.18.4
modelcontextprotocol	io.modelcontextprotocol.sdk:mcp-core	>= 1.0.0, < 1.1.4
modelcontextprotocol	io.modelcontextprotocol.sdk:mcp-core	>= 2.0.0-M1, < 2.0.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

This vulnerability is a denial-of-service (DoS) flaw in the Model Context Protocol Java SDK. It allows unauthenticated remote attackers to send HTTP POST requests with arbitrarily large bodies, including chunked transfer encoding, causing the server to exhaust its heap memory and crash. The issue occurs because the HTTP server transports read request bodies without enforcing size limits.

Detection Guidance

Check if your MCP Java SDK version is vulnerable by inspecting the artifact version in your project dependencies. For Maven, run: mvn dependency:tree | grep mcp-core or mvn dependency:list. For Gradle, use: gradle dependencies | grep mcp-core. If the version is below 0.18.4, 1.1.4, or 2.0.1, the system is vulnerable.

Impact Analysis

If you run an affected MCP Java SDK server, a single malicious request could crash your service by consuming all available memory. This disrupts service availability for legitimate users. The impact is highest if the server is exposed to untrusted networks without additional protections like request size limits.

Compliance Impact

This vulnerability primarily impacts service availability, which may violate availability requirements in GDPR (Article 32) and HIPAA (Security Rule). A DoS attack could lead to prolonged downtime, potentially causing data processing delays or unauthorized access during outages, depending on the system's design.

Mitigation Strategies

Upgrade to the fixed versions: 0.18.4, 1.1.4, or 2.0.1 for mcp-core. If immediate upgrade is not possible, configure a reverse proxy or gateway to enforce a 16 MiB request body size limit. Ensure authentication, Origin, or Host validation is enabled to block malicious requests before they reach vulnerable components.

Hi! I’m here to help you understand CVE-2026-108395. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70