MCP Python SDK EUVD-2026-101514

Requires an MCP Python SDK server exposing an HTTP-based transport - specifically the Streamable HTTP session manager, the SSE message endpoint, or the OAuth authorization-server routes - reachable by the attacker, running an affected version (before 1.29.1, or 2.0.0a1 through 2.0.1), with NO effective upstream request-size limit (e.g., no reverse proxy/gateway body cap). Exploitation is explicitly NOT possible against stdio-only servers, nor where an upstream component already enforces a body-size limit. Applications that call StreamableHTTPServerTransport directly are responsible for their own limit and may remain exposed even after SDK upgrade if they do not set one. No authentication (PR:N), user interaction, or special attacker privileges are needed against a qualifying default HTTP deployment.

This is a genuine but bounded-priority issue rather than a critical emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) is credible: an unauthenticated remote client over the network can trigger the flaw with low complexity against an affected HTTP-exposed endpoint, and the C:N/I:N/A:H profile correctly reflects a pure availability (memory-exhaustion / crash, CWE-770) impact with no confidentiality or integrity loss. The real-risk ceiling is lowered by meaningful scope constraints the description makes explicit: stdio-only servers are unaffected, and any deployment behind an upstream proxy or gateway enforcing a request-size limit is also unaffected - a very common production pattern. No EPSS score, no CISA KEV listing, and no public POC were provided in the input; by the precision rules this means no public exploit is identified at analysis time and exploitation is not confirmed active. Note the apparent conflict is only superficial: the network vector is real, but the practical attack surface is limited to SDK HTTP transports (Streamable HTTP session manager, SSE message endpoint, OAuth authorization-server routes) that lack an effective upstream body-size cap. Bottom line: patch-worthy availability bug, straightforward to exploit where exposed, but not a drop-everything incident absent evidence of in-the-wild use.

An attacker locates an internet-reachable MCP server built on the Python SDK using the Streamable HTTP transport (or SSE/OAuth routes) with no upstream body-size limit, then POSTs a very large declared or streamed request body to the message endpoint. Because the body is buffered in full before parsing - consuming multiple times its size in process memory - repeated requests exhaust RAM and crash or hang the server. No authentication or user interaction is required; no public exploit code was identified at the time of analysis, though the fixing commits are public.