CVE-2026-109527

Awaiting Analysis Awaiting Analysis - Queue

Memory Exhaustion in Model Context Protocol Python SDK

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP request bodies without enforcing a maximum size. An unauthenticated remote client able to reach an affected endpoint can send a large declared or streamed request body that consumes multiple times the body size in process memory and can repeatedly exhaust memory or terminate the server. Stdio-only servers and deployments with an effective upstream request-size limit are not affected, and applications that use StreamableHTTPServerTransport directly remain responsible for enforcing their own limit. The standard SDK server applications and session managers are fixed in versions 1.29.1 and 2.1.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-109527

EUVD

EUVD-2026-101514

Affected Vendors & Products

Vendor	Product	Version / Range
modelcontextprotocol	python-sdk	< 1.29.1
modelcontextprotocol	python-sdk	>= 2.0.0a1, < 2.1.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

CVE-2026-109527 is a denial-of-service vulnerability in the Model Context Protocol Python SDK. It affects HTTP server transports and OAuth endpoints that buffer complete HTTP request bodies without enforcing a maximum size. Attackers can send large requests, consuming excessive memory (2-3 times the request size) and crashing the server. The issue impacts versions before 1.29.1 and 2.0.0a1 through 2.0.1.

Detection Guidance

To detect this vulnerability, monitor for unusually large HTTP request bodies targeting MCP server endpoints. Check for repeated HTTP 413 errors or memory exhaustion events in server logs. Use network tools like tcpdump or Wireshark to capture and analyze HTTP traffic for oversized payloads.

Impact Analysis

An unauthenticated remote attacker can exploit this to exhaust server memory or terminate the server by sending oversized requests. This leads to service disruption, crashes, or degraded performance. Systems without upstream request-size limits or using stdio-only servers are not affected.

Compliance Impact

The vulnerability allows unauthenticated remote clients to send large request bodies that exhaust server memory, potentially causing denial-of-service. This could impact compliance with GDPR and HIPAA by disrupting availability of systems handling personal or health data. GDPR requires data availability while HIPAA mandates system reliability for protected health information. The lack of request size limits may violate these regulations by failing to ensure robust security and availability controls.

Mitigation Strategies

Upgrade to patched versions 1.29.1 or 2.1.0+ to enforce a 4 MiB default request body limit.
If upgrading is not possible, implement a reverse proxy or middleware to cap request sizes before they reach the server.
Configure the max_request_body_size parameter in StreamableHTTPServerTransport or FastMCP server initialization.

Hi! I’m here to help you understand CVE-2026-109527. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70