EUVD-2026-79124Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable unauthenticated HTTP transport gives AV:N/PR:N/UI:N; only availability is affected, and no scope change occurs.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
mcp-searxng is a Model Context Protocol server that gives AI assistants web search and URL-reading capabilities through SearXNG. Prior to 1.7.1, web_url_read in src/index.ts passes a caller-supplied URL to readUrlContent() in src/url-reader.ts, where checkContentLength() treats a missing Content-Length header as an inconclusive preflight and the normal and error paths then consume the complete body with response.text(). A server that omits Content-Length can therefore bypass URL_READ_MAX_CONTENT_LENGTH_BYTES and force unbounded memory use. The resulting string is also processed by NodeHtmlMarkdown.translate(), increasing CPU consumption and allowing an unauthenticated HTTP client to cause denial of service. This issue is fixed in version 1.7.1.
AnalysisAI
Unbounded memory consumption in the web_url_read tool of mcp-searxng before 1.7.1 lets a remote unauthenticated client exhaust the MCP server process by pointing it at an HTTP endpoint that omits (or understates) the Content-Length header. The 5 MiB URL_READ_MAX_CONTENT_LENGTH_BYTES guard is implemented as a HEAD preflight only, so when the header is absent the check short-circuits to false and the full response body is loaded via response.text() and then converted to Markdown, driving both memory and CPU usage toward exhaustion. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the mcp-searxng server has the web_url_read tool enabled (it is on by default) and that an attacker can influence the URL it fetches - either directly by calling the tool as an unauthenticated HTTP client when the server runs in HTTP transport mode (authentication disabled by default, giving CVSS PR:N/AV:N), or indirectly in stdio mode via prompt injection that persuades the AI model to request an attacker-controlled URL. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | CVSS 3.1 rates this 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) - full availability impact with no confidentiality or integrity effect, low attack complexity, and no authentication or user interaction required in HTTP transport mode, which the vendor advisory confirms is the default. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to mcp-searxng 1.7.1 or later, which replaces the HEAD-only size check with an authoritative streaming byte cap applied to the decompressed body; the exact fix is the vendor release v1.7.1 (https://github.com/ihor-sokoliuk/mcp-searxng/releases/tag/v1.7.1) delivered via PR #121 and commit f5a947ed1650daed10fbdcd53c0db5a86489ffe4, with guidance in GHSA-xcqx-9jf5-w339. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Mcp Searxng
View allSame weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today