CVE-2026-108859

HIGH 7.5

mcp-go through 1.2.1 Denial of Service via Unbounded POST Body Buffering

CVSS Score

7.5

EPSS Score

0.0%

EPSS Percentile

0th

mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that allows remote unauthenticated attackers to exhaust memory by sending oversized POST bodies. Attackers can send arbitrarily large or many concurrent POST requests, read fully via io.ReadAll before validation, to degrade or OOM-kill the server process.

CWE	CWE-770
Vendor	mark3labs
Product	mcp-go
Published	Oct 11, 2026

Stay Ahead of the Next One

Get instant alerts for mark3labs mcp-go

Be the first to know when new high vulnerabilities affecting mark3labs mcp-go are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

mark3labs / mcp-go

0 ≤ 1.2.1

References

NVD ↗ CVE.org ↗ EPSS Data ↗

hackmd.io: https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/mark3labs-mcp-go-streamable-http-unbounded-body github.com: https://github.com/mark3labs/mcp-go/blob/90d247ed8d45cbb7d71d9a95e112789b78760443/server/streamable_http.go#L405-L411 github.com: https://github.com/mark3labs/mcp-go vulncheck.com: https://www.vulncheck.com/advisories/mcp-go-through-1.2.1-denial-of-service-via-unbounded-post-body-buffering

Credits

hieuPenguinnn