mcp-go EUVD-2026-97010

The affected mcp-go StreamableHTTPServer HTTP transport must be deployed and network-reachable by the attacker; exploitation targets the POST handler in StreamableHTTPServer.ServeHTTP that reads the full request body via io.ReadAll before validating its size. No authentication, credentials, user interaction, or non-default configuration is required (PR:N/UI:N) - any process running mcp-go through 1.2.1 and accepting POST requests on this transport is exposed. Limiting factors are deployment-dependent: the endpoint must be exposed (internal-only or non-StreamableHTTP deployments reduce exposure), and an upstream reverse proxy or load balancer enforcing a request-body size limit (e.g. client_max_body_size) or per-client rate limiting would substantially blunt the attack. Impact is availability-only; no data is read or modified.

This is a credible, moderately-high-priority availability risk but not an emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) confirms remote, unauthenticated, low-complexity reachability against the HTTP transport, and the impact is confined to availability (VA:H; VC:N/VI:N) - consistent with CWE-770 (unbounded resource allocation) and the description's io.ReadAll-before-validation flaw. The 8.7 'High' score is driven entirely by availability, so this is a true DoS, not a data-breach or RCE issue; teams weighting confidentiality/integrity should rank it below code-execution bugs of similar score. No CISA KEV listing and no public exploit are present in the input, so there is no evidence of active exploitation - however, the bug class is trivially weaponizable (send large/many POST bodies) and a detailed third-party technical writeup (hackmd) plus a vendor advisory (VulnCheck) with a direct link to the vulnerable source lines lower the barrier to a working exploit considerably. No EPSS score was provided, so probabilistic exploitation likelihood cannot be compared; given the triviality, treat EPSS absence as a gap rather than reassurance. Net: patch promptly on any internet-exposed mcp-go StreamableHTTP deployment, but the lack of confidentiality/integrity impact and absence of confirmed exploitation justify prioritizing it below network-facing RCE.

A remote attacker who can reach an mcp-go StreamableHTTP endpoint sends one or more POST requests with arbitrarily large bodies (or many concurrent large requests); because ServeHTTP calls io.ReadAll to buffer the entire body before any size validation, server memory balloons. Sustained or concurrent requests exhaust available memory and trigger an OOM kill or severe degradation, taking the MCP server offline for all users. No authentication, user interaction, or special timing is required, and no public exploit is identified at time of analysis though a detailed technical writeup exists.