CVE-2026-14539
Received Received - Intake

Allocation of Resources Without Limits in Google mcp-toolbox HTTP Handler

Publication date: 2026-07-31

Last updated on: 2026-07-31

Assigner: Google Inc.

Description
An allocation of resources without limits vulnerability in the HTTP handler component of Google mcp-toolbox versions up to and including 1.4.0 allows an unauthenticated attacker to cause a denial of service (DoS). The /mcp endpoint handler reads incoming payloads directly into system memory using an unrestricted buffer loop (io.ReadAll) without applying defensive constraints such as http.MaxBytesReader or pre-read Content-Length enforcement. By submitting a single, massive HTTP request body, an attacker can linearly consume available host memory until the runtime process is terminated by an Out-Of-Memory (OOM) error.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-31
Last Modified
2026-07-31
Generated
2026-07-31
AI Q&A
2026-07-31
EPSS Evaluated
N/A
NVD
CVE-2026-14539
EUVD
EUVD-2026-51373

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
google mcp-toolbox to 1.4.0 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a denial of service (DoS) vulnerability in Google mcp-toolbox versions up to 1.4.0. It occurs in the HTTP handler component where the /mcp endpoint reads incoming payloads directly into system memory without size limits. Attackers can exploit this by sending a single massive HTTP request, consuming all available host memory until the process crashes due to an Out-Of-Memory error.

Detection Guidance

Monitor for unusually large HTTP request bodies or memory exhaustion events in the mcp-toolbox process. Check for processes consuming excessive memory or crashing due to OOM errors. Use tools like netstat, tcpdump, or Wireshark to inspect incoming HTTP traffic for abnormally large payloads targeting the /mcp endpoint.

Impact Analysis

An attacker could exploit this to crash the mcp-toolbox service on your system, causing downtime for applications relying on it. This may lead to service unavailability, disrupted operations, or degraded performance for users and dependent systems.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that disrupt system availability. GDPR requires maintaining data processing integrity and availability, while HIPAA mandates ensuring access to protected health information. A DoS condition could violate these requirements by making systems unavailable.

Mitigation Strategies

Upgrade mcp-toolbox to a version beyond 1.4.0 if available. Implement network-level protections such as rate limiting or WAF rules to block excessively large HTTP requests. Configure http.MaxBytesReader or enforce Content-Length limits in the HTTP handler to prevent unbounded memory consumption.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-14539. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart