MCP · CVE-2026-109527 · AI agents & MCP
FIX → 2.1.0 · 1.29.1
HTTP endpoints of servers built with the MCP Python SDK read whole request bodies into memory before checking size, so one large request multiplies memory use and can crash the process. An unauthenticated remote client can repeat this to take the server offline.
first public Sep 30, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Servers built on the MCP Python SDK that accept HTTP traffic from clients you do not fully trust are exposed, including the SSE transport, Streamable HTTP endpoint and OAuth authorization routes. Servers that use only stdio, pure MCP clients, and deployments behind a proxy that caps body size can skip it.
Not affected if body-size-capped-proxy, mcp-client-only, stdio-only
Who cares mcp, python, self-hosted
pip show mcp or pip freeze | grep mcp and compare the version to the affected ranges./token, /register, /revoke, /authorize) over HTTP rather than stdio only.In affected versions, an MCP server built with this SDK read the whole body of every HTTP request into memory before checking its size. One large request grew the process's memory by two to three times the size of the body, so a client that could reach the server over HTTP could exhaust its memory and take it offline, repeatedly. No credentials are needed against the OAuth endpoints, or against a server that does not require authentication (the default).
Yes, if clients you do not fully trust can reach your server over HTTP and it runs:
The limit arrived in two steps:
/token, /register, /revoke, /authorize).Not affected:
Upgrade to mcp 1.29.1 (1.x) or 2.1.0 (2.x) or later. There is no fixed 2.0.x release.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Upgrade to 2.1.0 · 1.29.1
mcp 1.x: upgrade to 1.29.1 or later.mcp 2.x: upgrade to 2.1.0 or later; there is no fixed 2.0.x release.Every HTTP endpoint the SDK provides then reads the body through one shared limit (default 4 MiB) and answers 413 as soon as a request declares or streams more than that, before any parsing.
If your clients send single messages larger than 4 MiB, raise the limit with max_request_body_size=:
FastMCP(..., max_request_body_size=...)MCPServer.run(), streamable_http_app(), sse_app()StreamableHTTPSessionManager / SseServerTransport when you construct them yourselfCode that drives StreamableHTTPServerTransport directly, without the session manager, does not get the limit and should bound request bodies itself. If you cannot upgrade yet, cap request body size in a reverse proxy or ASGI middleware in front of the server.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.