Mcp Go
Monthly
Unbounded request-body buffering in mark3labs mcp-go through 1.2.1 lets remote unauthenticated attackers exhaust server memory and OOM-kill the process by sending arbitrarily large or many concurrent POST requests to the StreamableHTTPServer HTTP transport. Because the handler calls io.ReadAll on the raw request body before any size validation occurs, a single oversized request or a modest burst of parallel requests can drive allocation without limit; no credentials or user interaction are required (CVSS:4.0 PR:N/UI:N, availability-only impact rated 8.7). There is no confirmed in-the-wild exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but the low complexity and network reachability make this a credible, moderately-high-priority availability risk for any deployment exposing the StreamableHTTP endpoint directly to untrusted networks.
DNS rebinding in mcp-go before 0.56.0 allows a malicious webpage to bypass localhost isolation and invoke tools or read resources on a victim's locally-running MCP server. Both StreamableHTTPServer and SSEServer accepted loopback connections without validating the Host header, and the SSE transport's permissive default CORS policy removed an additional browser-level barrier. No public exploit has been identified and no CISA KEV listing exists, but the attack is practical for any developer running an affected server while browsing the web.
Unbounded request-body buffering in mark3labs mcp-go through 1.2.1 lets remote unauthenticated attackers exhaust server memory and OOM-kill the process by sending arbitrarily large or many concurrent POST requests to the StreamableHTTPServer HTTP transport. Because the handler calls io.ReadAll on the raw request body before any size validation occurs, a single oversized request or a modest burst of parallel requests can drive allocation without limit; no credentials or user interaction are required (CVSS:4.0 PR:N/UI:N, availability-only impact rated 8.7). There is no confirmed in-the-wild exploitation (not in CISA KEV) and no public exploit code identified at time of analysis, but the low complexity and network reachability make this a credible, moderately-high-priority availability risk for any deployment exposing the StreamableHTTP endpoint directly to untrusted networks.
DNS rebinding in mcp-go before 0.56.0 allows a malicious webpage to bypass localhost isolation and invoke tools or read resources on a victim's locally-running MCP server. Both StreamableHTTPServer and SSEServer accepted loopback connections without validating the Host header, and the SSE transport's permissive default CORS policy removed an additional browser-level barrier. No public exploit has been identified and no CISA KEV listing exists, but the attack is practical for any developer running an affected server while browsing the web.