CVE-2026-58483
Received Received - Intake

Memory Exhaustion in mcp-searxng via Missing Content-Length Header

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: GitHub, Inc.

Description
mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.7.1, web_url_read in src/index.ts passes a caller-supplied URL to readUrlContent() in src/url-reader.ts, where checkContentLength() treats a missing Content-Length header as an inconclusive preflight and the normal and error paths then consume the complete body with response.text(). A server that omits Content-Length can therefore bypass URL_READ_MAX_CONTENT_LENGTH_BYTES and force unbounded memory use. The resulting string is also processed by NodeHtmlMarkdown.translate(), increasing CPU consumption and allowing an unauthenticated HTTP client to cause denial of service. This issue is fixed in version 1.7.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-58483
EUVD
EUVD-2026-79124

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ihor_sokoliuk mcp-searxng 1.7.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects mcp-searxng, a tool that allows AI assistants to perform web searches via SearXNG. The issue is in the web_url_read function, which failed to properly enforce a response size limit. When a server omits the Content-Length header, the function would read the entire response body into memory without restrictions, leading to excessive memory and CPU usage. This could cause a denial-of-service (DoS) attack by overwhelming system resources.

Detection Guidance

To detect this vulnerability, monitor for unusually high memory or CPU usage by the mcp-searxng process. Check if the service is processing large responses without proper size limits. Use tools like `htop` or `ps` to observe resource consumption. Verify if the service is running a vulnerable version (<1.7.1) by checking the installed version with `npm list mcp-searxng` or inspecting the source code for the absence of the streaming reader fix.

Impact Analysis

If you use mcp-searxng versions 1.6.0 or earlier, an attacker could exploit this flaw to send oversized responses, consuming excessive memory and CPU on your server. This may lead to system slowdowns, crashes, or service unavailability. The attack can be executed remotely by an unauthenticated user who controls or redirects to a malicious HTTP endpoint.

Mitigation Strategies

Upgrade mcp-searxng to version 1.7.1 or later immediately. If upgrading is not possible, set the `URL_READ_MAX_CONTENT_LENGTH_BYTES` environment variable to a safe value (e.g., 5242880 for 5MB) and restart the service. Ensure the streaming reader is enforced by verifying the configuration matches the patched implementation. Monitor for any ongoing attacks or unusual traffic patterns.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-58483. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart