{"id":"CVE-2026-109527","kind":"vulnerability","aliases":["CVE-2026-109527","GHSA-fmmv-w9g8-j3gc"],"related":[],"title":"HTTP server transports and OAuth endpoints read request bodies with no size limit","description":"### Summary\nIn affected versions, an MCP server built with this SDK read the whole body of every HTTP request into memory before checking its size. One large request grew the process's memory by two to three times the size of the body, so a client that could reach the server over HTTP could exhaust its memory and take it offline, repeatedly. No credentials are needed against the OAuth endpoints, or against a server that does not require authentication (the default).\n\n### Am I affected?\nYes, if clients you do not fully trust can reach your server over HTTP and it runs:\n\n- 1.x before 1.29.1, or\n- 2.0.0 or 2.0.1.\n\nThe limit arrived in two steps:\n\n- 1.29.0 and 2.0.0 added a 4 MiB limit to the Streamable HTTP endpoint only.\n- 1.29.1 and 2.1.0 extended it to the SSE transport's message endpoint and the OAuth authorization server routes (`/token`, `/register`, `/revoke`, `/authorize`).\n\nNot affected:\n\n- servers that only use the stdio transport\n- MCP clients\n- deployments behind a reverse proxy or gateway that already caps request body size\n\n### Fix\nUpgrade to `mcp` 1.29.1 (1.x) or 2.1.0 (2.x) or later. There is no fixed 2.0.x release.\n\nEvery HTTP endpoint the SDK provides then reads the body through one shared limit (default 4 MiB) and answers `413` as soon as a request declares or streams more than that, before any parsing.\n\nIf your clients send single messages larger than 4 MiB, raise the limit with `max_request_body_size=`:\n\n- 1.x: `FastMCP(..., max_request_body_size=...)`\n- 2.x: `MCPServer.run()`, `streamable_http_app()`, `sse_app()`\n- or `StreamableHTTPSessionManager` / `SseServerTransport` when you construct them yourself\n\nCode that drives `StreamableHTTPServerTransport` directly, without the session manager, does not get the limit and should bound request bodies itself. If you cannot upgrade yet, cap request body size in a reverse proxy or ASGI middleware in front of the server.","summary":"HTTP endpoints of servers built with the MCP Python SDK read whole request bodies into memory before checking size, so one large request multiplies memory use and can crash the process. An unauthenticated remote client can repeat this to take the server offline.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"mcp","fixed":["1.29.1"],"affected":"< 1.29.1","ecosystem":"pypi"},{"name":"mcp","fixed":["2.1.0"],"affected":">= 2.0.0, < 2.1.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["ai-tooling","cwe-770","mcp","python","self-hosted"],"not_affected_if":["body-size-capped-proxy","mcp-client-only","stdio-only"],"how_to_check":"- Run `pip show mcp` or `pip freeze | grep mcp` and compare the version to the affected ranges.\n- Check whether the server uses the SSE transport, Streamable HTTP, or the OAuth routes (`/token`, `/register`, `/revoke`, `/authorize`) over HTTP rather than stdio only.\n- Check for a reverse proxy or gateway that already caps request body size.","fix":"- `mcp` 1.x: upgrade to `1.29.1` or later.\n- `mcp` 2.x: upgrade to `2.1.0` or later; there is no fixed 2.0.x release.","status":"open","published_at":"2026-09-30T20:53:39+00:00","first_seen_at":"2026-11-09T22:53:24+00:00","triaged_at":"2026-11-09T22:59:24+00:00","updated_at":"2026-11-09T22:59:24+00:00","category":"ai-tooling","confidence":0.85,"triage":{"at":"2026-11-09T22:59:24Z","model":"claude-haiku-5-5","output":{"fix":"- `mcp` 1.x: upgrade to `1.29.1` or later.\n- `mcp` 2.x: upgrade to `2.1.0` or later; there is no fixed 2.0.x release.","reach":"internet","title":"MCP Python SDK: unbounded request bodies let remote clients exhaust server memory","impact":"medium","summary":"HTTP endpoints of servers built with the MCP Python SDK read whole request bodies into memory before checking size, so one large request multiplies memory use and can crash the process. An unauthenticated remote client can repeat this to take the server offline.","audience":"developers","category":"ai-tooling","nicknames":[],"who_cares":["mcp","python","self-hosted"],"confidence":0.85,"fix_status":"available","needs_auth":"no","worst_case":"remote client exhausts server memory and takes it offline repeatedly","analyst_note":"","how_to_check":"- Run `pip show mcp` or `pip freeze | grep mcp` and compare the version to the affected ranges.\n- Check whether the server uses the SSE transport, Streamable HTTP, or the OAuth routes (`/token`, `/register`, `/revoke`, `/authorize`) over HTTP rather than stdio only.\n- Check for a reverse proxy or gateway that already caps request body size.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["stdio-only","mcp-client-only","body-size-capped-proxy"],"who_is_affected":"Servers built on the MCP Python SDK that accept HTTP traffic from clients you do not fully trust are exposed, including the SSE transport, Streamable HTTP endpoint and OAuth authorization routes. Servers that use only stdio, pure MCP clients, and deployments behind a proxy that caps body size can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000866,"input_tokens":5287,"output_tokens":674,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-109527':16A,24A '-2026':15A,23A '-770':31B '/authorize':230C '/register':228C '/revoke':229C '/token':227C '1':181C,260C,327C '1.29.0':195C '1.29.1':184C,209C,259C '2':264C,334C '2.0':272C '2.0.0':186C,197C '2.0.1':188C '2.1.0':211C,263C '4':200C,290C,317C '413':294C 'add':198C 'affect':82C,163C,232C 'ai':28B 'ai-tool':27B 'alreadi':250C 'answer':293C 'app':339C,341C 'arriv':191C 'asgi':384C 'authent':158C 'author':224C 'behind':243C 'bodi':9A,50B,94C,122C,253C,284C,325C,332C,368C,377C 'bound':366C 'built':41B,87C 'cannot':372C 'cap':251C,375C 'check':54B,102C 'client':71B,125C,166C,241C,311C 'code':350C 'construct':347C 'could':127C,133C 'crash':65B 'credenti':143C 'cve':14A,22A 'cwe':30B 'declar':300C 'default':160C,289C 'deploy':242C 'direct':354C 'drive':352C 'endpoint':6A,38B,149C,207C,220C,277C 'everi':96C,275C 'exhaust':134C 'extend':212C 'fastmcp':329C 'fix':255C,271C 'fmmv':19A 'front':387C 'fulli':170C 'gateway':248C 'get':361C 'ghsa':18A 'ghsa-fmmv-w9g8-j3gc':17A 'grew':108C 'host':36B 'http':1A,37B,97C,132C,177C,206C,276C,338C 'j3gc':21A 'larg':58B,106C 'larger':315C 'later':267C 'limit':13A,190C,202C,288C,321C,363C 'manag':358C 'max':323C,330C 'mcp':25A,26A,32B,44B,85C,240C,258C 'mcpserver.run':336C 'memori':52B,61B,100C,112C,136C 'messag':219C,314C 'mib':201C,291C,318C 'middlewar':385C 'multipli':60B 'need':145C 'oauth':5A,148C,223C 'offlin':79B,140C 'one':57B,105C,286C 'pars':308C 'process':67B,110C 'provid':280C 'proxi':246C,382C 'python':33B,45B 'rais':319C 'reach':128C,173C 'read':7A,47B,91C,282C 'releas':274C 'remot':70B 'repeat':73B,141C 'request':8A,49B,59B,98C,107C,252C,299C,324C,331C,367C,376C 'requir':157C 'revers':245C,381C 'rout':226C 'run':180C 'sdk':46B,90C,279C 'self':35B 'self-host':34B 'send':312C 'server':2A,40B,78B,86C,130C,153C,175C,225C,233C,390C 'session':357C 'share':287C 'singl':313C 'size':12A,55B,104C,119C,254C,326C,333C,378C 'soon':296C 'sse':216C,340C 'sseservertransport':344C 'stdio':238C 'step':194C 'stream':302C 'streamabl':205C,337C 'streamablehttpservertransport':353C 'streamablehttpsessionmanag':343C 'summari':80C 'take':76B,138C 'three':116C 'time':117C 'tool':29B 'transport':3A,217C,239C 'trust':171C 'two':114C,193C 'unauthent':69B 'upgrad':256C,373C 'use':62B,236C 'version':83C 'w9g8':20A 'whole':48B,93C 'without':355C 'x':182C,261C,265C,273C,328C,335C 'yes':164C 'yet':374C","nicknames":[],"mitigations":[],"who_affected":"Servers built on the MCP Python SDK that accept HTTP traffic from clients you do not fully trust are exposed, including the SSE transport, Streamable HTTP endpoint and OAuth authorization routes. Servers that use only stdio, pure MCP clients, and deployments behind a proxy that caps body size can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["mcp"],"ptokens":["mcp"],"labels":["aitooling","cwe770","high","mcp","pypi","python","selfhosted"],"campaign_type":null,"search_a":"'-109527':16A,24A '-2026':15A,23A 'bodi':9A 'cve':14A,22A 'endpoint':6A 'fmmv':19A 'ghsa':18A 'ghsa-fmmv-w9g8-j3gc':17A 'http':1A 'j3gc':21A 'limit':13A 'mcp':25A,26A 'oauth':5A 'read':7A 'request':8A 'server':2A 'size':12A 'transport':3A 'w9g8':20A","search_b":"'-770':31B 'ai':28B 'ai-tool':27B 'bodi':50B 'built':41B 'check':54B 'client':71B 'crash':65B 'cwe':30B 'endpoint':38B 'host':36B 'http':37B 'larg':58B 'mcp':32B,44B 'memori':52B,61B 'multipli':60B 'offlin':79B 'one':57B 'process':67B 'python':33B,45B 'read':47B 'remot':70B 'repeat':73B 'request':49B,59B 'sdk':46B 'self':35B 'self-host':34B 'server':40B,78B 'size':55B 'take':76B 'tool':29B 'unauthent':69B 'use':62B 'whole':48B","search_c":"'/authorize':230C '/register':228C '/revoke':229C '/token':227C '1':181C,260C,327C '1.29.0':195C '1.29.1':184C,209C,259C '2':264C,334C '2.0':272C '2.0.0':186C,197C '2.0.1':188C '2.1.0':211C,263C '4':200C,290C,317C '413':294C 'add':198C 'affect':82C,163C,232C 'alreadi':250C 'answer':293C 'app':339C,341C 'arriv':191C 'asgi':384C 'authent':158C 'author':224C 'behind':243C 'bodi':94C,122C,253C,284C,325C,332C,368C,377C 'bound':366C 'built':87C 'cannot':372C 'cap':251C,375C 'check':102C 'client':125C,166C,241C,311C 'code':350C 'construct':347C 'could':127C,133C 'credenti':143C 'declar':300C 'default':160C,289C 'deploy':242C 'direct':354C 'drive':352C 'endpoint':149C,207C,220C,277C 'everi':96C,275C 'exhaust':134C 'extend':212C 'fastmcp':329C 'fix':255C,271C 'front':387C 'fulli':170C 'gateway':248C 'get':361C 'grew':108C 'http':97C,132C,177C,206C,276C,338C 'larg':106C 'larger':315C 'later':267C 'limit':190C,202C,288C,321C,363C 'manag':358C 'max':323C,330C 'mcp':85C,240C,258C 'mcpserver.run':336C 'memori':100C,112C,136C 'messag':219C,314C 'mib':201C,291C,318C 'middlewar':385C 'need':145C 'oauth':148C,223C 'offlin':140C 'one':105C,286C 'pars':308C 'process':110C 'provid':280C 'proxi':246C,382C 'rais':319C 'reach':128C,173C 'read':91C,282C 'releas':274C 'repeat':141C 'request':98C,107C,252C,299C,324C,331C,367C,376C 'requir':157C 'revers':245C,381C 'rout':226C 'run':180C 'sdk':90C,279C 'send':312C 'server':86C,130C,153C,175C,225C,233C,390C 'session':357C 'share':287C 'singl':313C 'size':104C,119C,254C,326C,333C,378C 'soon':296C 'sse':216C,340C 'sseservertransport':344C 'stdio':238C 'step':194C 'stream':302C 'streamabl':205C,337C 'streamablehttpservertransport':353C 'streamablehttpsessionmanag':343C 'summari':80C 'take':138C 'three':116C 'time':117C 'transport':217C,239C 'trust':171C 'two':114C,193C 'upgrad':256C,373C 'use':236C 'version':83C 'whole':93C 'without':355C 'x':182C,261C,265C,273C,328C,335C 'yes':164C 'yet':374C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-09-30T20:53:39+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-fmmv-w9g8-j3gc","url":"https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-fmmv-w9g8-j3gc","severity":"high","published_at":"2026-09-30T20:53:39+00:00","modified_at":"2026-10-14T17:40:54+00:00","first_seen_at":"2026-11-09T22:53:24+00:00","fetched_at":"2026-11-09T22:53:24+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-109527","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109527","severity":null,"published_at":"2026-10-14T18:17:33+00:00","modified_at":"2026-10-20T02:17:08+00:00","first_seen_at":"2026-11-09T23:10:12+00:00","fetched_at":"2026-11-09T23:10:12+00:00","note":null}],"documents":[{"id":110613,"url":"https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-fmmv-w9g8-j3gc","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":"2026-09-30T20:53:39+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":111056,"url":"https://github.com/modelcontextprotocol/python-sdk/commit/4dc224fab201bdef2fd5a065976b7ca31420187c","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":111057,"url":"https://github.com/modelcontextprotocol/python-sdk/commit/57394b0548d1e2dc2dce8d67d84985769df3b8bb","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":111055,"url":"https://github.com/modelcontextprotocol/python-sdk/commit/03aaebd3aadb2567878dd811cb1f141454e8a080","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":111059,"url":"https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.29.1","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":111060,"url":"https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.1.0","title":"Release notes: github.com","kind":"release","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release notes: github.com"},{"id":111058,"url":"https://github.com/modelcontextprotocol/python-sdk/commit/5f0b6af9f2b0aad3be3ba5cbfe80a9e4ea32e189","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}