CVE-2026-108395

7.5High

Published 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash

7.5High

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None
Impact: High impact on availability
Weakness: CWE-770

Impact

Unauthenticated remote attackers can crash the Java application via denial of service by exhausting heap memory. They only need network access to reach an affected MCP server transport with a large POST request.

Root cause

Servlet-based server transports read the entire incoming HTTP POST body into memory without enforcing a maximum payload size limit.

Affected systems

io.modelcontextprotocol.sdk:mcp 0.8.0 through 0.12.0; io.modelcontextprotocol.sdk:mcp-core 0.13.0 through 0.18.3, 1.0.0 through 1.1.3, and 2.0.0-M1 through 2.0.0

CVSS v3.1 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fix & remediation

Upgrade mcp-core dependency to 0.18.4, 1.1.4, or 2.0.1. If patching immediately is not possible, enforce a request body size limit at an upstream reverse proxy or require authentication before requests reach the transport.

AI-suggested. Run it in staging first and check it against the vendor advisory. Why?

Ad · In-content banner

NVD description

The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through 1.1.3 in io.modelcontextprotocol.sdk:mcp-core, and from mcp-core 2.0.0-M1 through 2.0.0, the Servlet-based SSE, Streamable HTTP, and Stateless server transports read an HTTP request body into memory without enforcing a maximum size. An unauthenticated remote client able to reach an affected transport can stream an arbitrarily large POST body, including with chunked transfer encoding, until the Java process exhausts its heap and becomes unavailable. Authentication, Origin or Host validation, or an upstream request-size limit can reject the request before the vulnerable read. The maintained mcp-core lines are fixed in versions 0.18.4, 1.1.4, and 2.0.1.

References

Source: nvd.nist.gov/vuln/detail/CVE-2026-108395