---
id: "CVE-2026-109527"
page: "https://infrastack.ai/live/CVE-2026-109527"
kind: "vulnerability"
aliases: ["CVE-2026-109527", "GHSA-fmmv-w9g8-j3gc"]
title: "HTTP server transports and OAuth endpoints read request bodies with no size limit"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "ai-tooling"
products: [{"name": "mcp", "fixed": ["1.29.1"], "affected": "< 1.29.1", "ecosystem": "pypi"}, {"name": "mcp", "fixed": ["2.1.0"], "affected": ">= 2.0.0, < 2.1.0", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["ai-tooling", "cwe-770", "mcp", "python", "self-hosted"]
not_affected_if: ["body-size-capped-proxy", "mcp-client-only", "stdio-only"]
published_at: "2026-09-30T20:53:39+00:00"
first_seen_at: "2026-11-09T22:53:24+00:00"
updated_at: "2026-11-09T22:59:24+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-fmmv-w9g8-j3gc", "first_seen_at": "2026-11-09T22:53:24+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109527", "first_seen_at": "2026-11-09T23:10:12+00:00"}]
exploit_sources: []
---

# HTTP server transports and OAuth endpoints read request bodies with no size limit

Link for people: https://infrastack.ai/live/CVE-2026-109527 (this .md is for agents)

HTTP endpoints of servers built with the MCP Python SDK read whole request bodies into memory before checking size, so one large request multiplies memory use and can crash the process. An unauthenticated remote client can repeat this to take the server offline.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:mcp affected < 1.29.1 fixed 1.29.1
- pypi:mcp affected >= 2.0.0, < 2.1.0 fixed 2.1.0

## How to check

- Run `pip show mcp` or `pip freeze | grep mcp` and compare the version to the affected ranges.
- Check whether the server uses the SSE transport, Streamable HTTP, or the OAuth routes (`/token`, `/register`, `/revoke`, `/authorize`) over HTTP rather than stdio only.
- Check for a reverse proxy or gateway that already caps request body size.

## Fix

- `mcp` 1.x: upgrade to `1.29.1` or later.
- `mcp` 2.x: upgrade to `2.1.0` or later; there is no fixed 2.0.x release.

## Timeline

- 2026-11-09T22:53:24+00:00 ghsa-repo https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-fmmv-w9g8-j3gc
- 2026-11-09T23:10:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-109527

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-fmmv-w9g8-j3gc
- [fix] Patch: github.com https://github.com/modelcontextprotocol/python-sdk/commit/4dc224fab201bdef2fd5a065976b7ca31420187c
- [fix] Patch: github.com https://github.com/modelcontextprotocol/python-sdk/commit/57394b0548d1e2dc2dce8d67d84985769df3b8bb
- [fix] Patch: github.com https://github.com/modelcontextprotocol/python-sdk/commit/03aaebd3aadb2567878dd811cb1f141454e8a080
- [fix] Release notes: github.com https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.29.1
- [fix] Release notes: github.com https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.1.0
- [fix] Patch: github.com https://github.com/modelcontextprotocol/python-sdk/commit/5f0b6af9f2b0aad3be3ba5cbfe80a9e4ea32e189

## From the sources

### Summary
In affected versions, an MCP server built with this SDK read the whole body of every HTTP request into memory before checking its size. One large request grew the process's memory by two to three times the size of the body, so a client that could reach the server over HTTP could exhaust its memory and take it offline, repeatedly. No credentials are needed against the OAuth endpoints, or against a server that does not require authentication (the default).

### Am I affected?
Yes, if clients you do not fully trust can reach your server over HTTP and it runs:

- 1.x before 1.29.1, or
- 2.0.0 or 2.0.1.

The limit arrived in two steps:

- 1.29.0 and 2.0.0 added a 4 MiB limit to the Streamable HTTP endpoint only.
- 1.29.1 and 2.1.0 extended it to the SSE transport's message endpoint and the OAuth authorization server routes (`/token`, `/register`, `/revoke`, `/authorize`).

Not affected:

- servers that only use the stdio transport
- MCP clients
- deployments behind a reverse proxy or gateway that already caps request body size

### Fix
Upgrade to `mcp` 1.29.1 (1.x) or 2.1.0 (2.x) or later. There is no fixed 2.0.x release.

Every HTTP endpoint the SDK provides then reads the body through one shared limit (default 4 MiB) and answers `413` as soon as a request declares or streams more than that, before any parsing.

If your clients send single messages larger than 4 MiB, raise the limit with `max_request_body_size=`:

- 1.x: `FastMCP(..., max_request_body_size=...)`
- 2.x: `MCPServer.run()`, `streamable_http_app()`, `sse_app()`
- or `StreamableHTTPSessionManager` / `SseServerTransport` when you construct them yourself

Code that drives `StreamableHTTPServerTransport` directly, without the session manager, does not get the limit and should bound request bodies itself. If you cannot upgrade yet, cap request body size in a reverse proxy or ASGI middleware in front of the server.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_