MCP Java SDK EUVD-2026-101503

Exploitation requires network reachability to one of the affected server transports - the Servlet-based SSE, Streamable HTTP, or Stateless transport - accepting POST requests, running an affected version (io.modelcontextprotocol.sdk:mcp 0.8.0-0.12.0, mcp-core 0.13.0-0.18.3, 1.0.0-1.1.3, or 2.0.0-M1-2.0.0). The following explicitly LIMIT exploitation and will reject the request before the vulnerable read: enabled authentication on the transport, Origin or Host header validation, or any upstream request-size/body limit such as a reverse proxy, load balancer, or API gateway maximum-body-size setting. Consequently, an MCP server deployed behind a proxy that caps request body size, or one requiring authentication, is not practically exploitable even though the raw CVSS vector is PR:N.

The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) is consistent with the description: an unauthenticated, remote, low-complexity attack with no user interaction that impacts availability only (C:N/I:N). This is a classic CWE-770 unbounded-resource-consumption denial of service - the affected Servlet-based SSE, Streamable HTTP, and Stateless transports read an HTTP POST body into heap memory without a size cap, so a single large or chunked request can OOM the JVM. No EPSS score was provided in the input, the CVE is NOT on CISA KEV, and no public exploit (POC) is referenced, so the real-world exploitation signal is currently absent - this is a high-CVSS issue whose practical priority depends heavily on exposure. Crucially, the vulnerable read only triggers if the transport is directly reachable AND not already protected: the description explicitly states that authentication, Origin/Host validation, or any upstream request-size limit (e.g., a reverse proxy or API gateway) rejects the request before the vulnerable read. Therefore, despite the PR:N vector, many production deployments fronted by a proxy with body limits are effectively not exploitable, which argues for prioritizing internet-exposed, unproxied MCP server instances over blanket emergency patching.

An attacker who can reach an exposed MCP Java SDK server transport (Servlet SSE, Streamable HTTP, or Stateless) sends a single HTTP POST with an arbitrarily large or chunked-transfer-encoded body to the transport endpoint. The server reads the entire body into memory without a size limit, exhausting the JVM heap and crashing or hanging the process, denying service to all MCP clients. No authentication is required and no public exploit code is referenced, but the trivial nature of the request makes weaponization straightforward.