EUVD-2026-51373
GHSA-623p-8r6m-hwc6
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable endpoint, no authentication (PR:N), no complexity; only availability is impacted with no scope change.
Primary rating from Vendor (Google).
CVSS VectorVendor: Google
Lifecycle Timeline
2DescriptionCVE.org
An allocation of resources without limits vulnerability in the HTTP handler component of Google mcp-toolbox versions up to and including 1.4.0 allows an unauthenticated attacker to cause a denial of service (DoS). The /mcp endpoint handler reads incoming payloads directly into system memory using an unrestricted buffer loop (io.ReadAll) without applying defensive constraints such as http.MaxBytesReader or pre-read Content-Length enforcement. By submitting a single, massive HTTP request body, an attacker can linearly consume available host memory until the runtime process is terminated by an Out-Of-Memory (OOM) error.
AnalysisAI
Unbounded memory consumption in Google mcp-toolbox versions through 1.4.0 allows unauthenticated remote attackers to crash the service via a single oversized HTTP request. The /mcp endpoint's toolInvokeHandler uses Go's io.ReadAll without any body-size guard - no http.MaxBytesReader, no Content-Length pre-check - so a sufficiently large POST body linearly exhausts host RAM until the OS OOM killer terminates the process. No active exploitation is confirmed (CVSS 4.0 E:U), but the attack requires no authentication and trivial complexity, making any internet-exposed deployment an easy target for denial of service.
Technical ContextAI
Google mcp-toolbox is an open-source Model Context Protocol (MCP) server written in Go, used to expose tools to LLM-based agents over HTTP. The vulnerable component is the toolInvokeHandler function in internal/server/api.go, which processes POST requests to the /mcp and /tool/{name}/invoke endpoints. Go's io.ReadAll reads from an io.Reader until EOF, allocating heap memory as needed with no upper bound. CWE-770 (Allocation of Resources Without Limits or Throttling) is the precise root cause: the absence of http.MaxBytesReader or equivalent Content-Length enforcement before io.ReadAll means the Go runtime will honor arbitrarily large request bodies, bounded only by available physical and virtual memory. The fix in PR #3216 wraps r.Body with http.MaxBytesReader prior to reading, adds a --http-max-request-bytes CLI flag, and defaults the limit to 10,485,760 bytes (10 MB) as documented in docs/en/reference/cli.md.
RemediationAI
Apply the upstream fix from GitHub PR #3216 (https://github.com/googleapis/mcp-toolbox/pull/3216) which introduces http.MaxBytesReader on the request body before io.ReadAll, defaulting to 10,485,760 bytes (10 MB) and configurable via the --http-max-request-bytes flag (e.g., --http-max-request-bytes 2097152 for 2 MB). A released patched version number is not independently confirmed - track the mcp-toolbox releases page for a tagged version incorporating this PR. As an interim compensating control, deploy a reverse proxy such as nginx in front of mcp-toolbox and enforce client_max_body_size to an appropriate limit; note that this adds an infrastructure dependency and does not fix the application layer. Alternatively, restrict network access to the /mcp endpoint to trusted internal clients or authenticated upstream services only, accepting that this may not be viable for public-facing MCP deployments.
More in Mcp Toolbox
View allAuthorization bypass in Google mcp-toolbox v1.3.0 and v1.4.0 lets an unauthenticated remote attacker invoke tools that w
Authentication bypass via OAuth audience confusion in Google mcp-toolbox 1.4.0 lets any holder of a valid Google OAuth a
Server-Side Request Forgery in Google mcp-toolbox versions 0.3.0 through 1.4.0 lets remote attackers coerce the toolbox
Authorization bypass in Google mcp-toolbox's bigquery-execute-sql tool (versions 0.16.1-1.4.0) allows authenticated low-
Same technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today