Mcp Searxng
Monthly
Unbounded memory consumption in the web_url_read tool of mcp-searxng before 1.7.1 lets a remote unauthenticated client exhaust the MCP server process by pointing it at an HTTP endpoint that omits (or understates) the Content-Length header. The 5 MiB URL_READ_MAX_CONTENT_LENGTH_BYTES guard is implemented as a HEAD preflight only, so when the header is absent the check short-circuits to false and the full response body is loaded via response.text() and then converted to Markdown, driving both memory and CPU usage toward exhaustion. Exploit code and a Docker-based proof of concept are published in the vendor's GHSA advisory, and the flaw is fixed in 1.7.1; CISA KEV listing and EPSS scoring are not present in the supplied data.
Let me analyze this CVE. CVE-2026-58485: mcp-searxng SSRF via DNS-resolved private hostname in web_url_read. Fixed in 1.7.1. CVSS: 7.1, CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N — note AV:L odd given "unauthenticated network client" in default HTTP config. Actually the vendor says network client can use this path. But CVSS says AV:L. Hmm, conflicting. I should note that in risk_assessment. CWE-918 SSRF. Tags: SSRF, Mcp Searxng. SSVC: Exploitation: poc, Automatable: no, Technical Impact: partial. Patch: available from vendor — PR/commit and release v1.7.1. So "Vendor-released patch: 1.7.1". Prevalence: mcp-searxng is a niche MCP server — low. Let me build the JSON. Product name: "mcp-searxng". Summary: SSRF in mcp-searxng prior to 1.7.1 — web_url_read validates only lexical hostname... Assessed CVSS vector: I need my own. Let's think. The vulnerability: an attacker-controlled hostname resolving to private IP. In default HTTP configuration, unauthenticated network client can call the tool. Vector-wise the attacker needs to induce the MCP server to fetch a URL — via network HTTP transport (AV:N) or via STDIO prompt injection (AV:L/UI... ). The vendor's CVSS is AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N = 7.1. My assessment: Network attack vector if HTTP transport exposed. But there's a nuance: in STDIO deployments it requires prompt influence. The tool only reads; no integrity/availability impact; scope changed (S:C) since the MCP server connects to internal hosts, impacting other systems. I'd go with CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N — that would be 8.6ish. Hmm. Let me compute: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N = base 8.6. Actually let's compute: ISS = 1 - (1-0.56)(1-0)(1-0) = 0.56. Impact = 7.52*(ISS-0.029) - 3.25*(ISS-0.02)^15 = 7.52*0.531 - 3.25*(0.54)^15. 0.54^15 ≈ e^(15*ln0.54)= e^(15*-0.616)= e^-9.24 = 9.7e-5. So 3.25*9.7e-5 ≈ 0.0003. Impact = 3.993 - 0.0003 = 3.993. Exploitability = 8.22*1*1*1 = 8.22... wait with S:C, exploitability uses PR
Unbounded memory consumption in the web_url_read tool of mcp-searxng before 1.7.1 lets a remote unauthenticated client exhaust the MCP server process by pointing it at an HTTP endpoint that omits (or understates) the Content-Length header. The 5 MiB URL_READ_MAX_CONTENT_LENGTH_BYTES guard is implemented as a HEAD preflight only, so when the header is absent the check short-circuits to false and the full response body is loaded via response.text() and then converted to Markdown, driving both memory and CPU usage toward exhaustion. Exploit code and a Docker-based proof of concept are published in the vendor's GHSA advisory, and the flaw is fixed in 1.7.1; CISA KEV listing and EPSS scoring are not present in the supplied data.
Let me analyze this CVE. CVE-2026-58485: mcp-searxng SSRF via DNS-resolved private hostname in web_url_read. Fixed in 1.7.1. CVSS: 7.1, CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N — note AV:L odd given "unauthenticated network client" in default HTTP config. Actually the vendor says network client can use this path. But CVSS says AV:L. Hmm, conflicting. I should note that in risk_assessment. CWE-918 SSRF. Tags: SSRF, Mcp Searxng. SSVC: Exploitation: poc, Automatable: no, Technical Impact: partial. Patch: available from vendor — PR/commit and release v1.7.1. So "Vendor-released patch: 1.7.1". Prevalence: mcp-searxng is a niche MCP server — low. Let me build the JSON. Product name: "mcp-searxng". Summary: SSRF in mcp-searxng prior to 1.7.1 — web_url_read validates only lexical hostname... Assessed CVSS vector: I need my own. Let's think. The vulnerability: an attacker-controlled hostname resolving to private IP. In default HTTP configuration, unauthenticated network client can call the tool. Vector-wise the attacker needs to induce the MCP server to fetch a URL — via network HTTP transport (AV:N) or via STDIO prompt injection (AV:L/UI... ). The vendor's CVSS is AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N = 7.1. My assessment: Network attack vector if HTTP transport exposed. But there's a nuance: in STDIO deployments it requires prompt influence. The tool only reads; no integrity/availability impact; scope changed (S:C) since the MCP server connects to internal hosts, impacting other systems. I'd go with CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N — that would be 8.6ish. Hmm. Let me compute: AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N = base 8.6. Actually let's compute: ISS = 1 - (1-0.56)(1-0)(1-0) = 0.56. Impact = 7.52*(ISS-0.029) - 3.25*(ISS-0.02)^15 = 7.52*0.531 - 3.25*(0.54)^15. 0.54^15 ≈ e^(15*ln0.54)= e^(15*-0.616)= e^-9.24 = 9.7e-5. So 3.25*9.7e-5 ≈ 0.0003. Impact = 3.993 - 0.0003 = 3.993. Exploitability = 8.22*1*1*1 = 8.22... wait with S:C, exploitability uses PR