CVE-2026-108859 Details

A denial-of-service vulnerability has been identified in mark3labs mcp-go versions through 1.2.1. The issue resides in the StreamableHTTPServer's ServeHTTP method, where the server reads the entire body of POST requests into memory without any prior validation or size limits. This flaw allows remote, unauthenticated attackers to send oversized POST bodies, leading to memory exhaustion and potentially causing the server process to be terminated. The vulnerability is exacerbated by the absence of default request-body limits in Go's net/http package, allowing attackers to exploit the issue by sending large or numerous concurrent POST requests.

To address this vulnerability, the body should be capped before it is read into memory. This can be done by using the http.MaxBytesReader function to limit the size of the request body. Additionally, the server should reject oversized Content-Length headers with an HTTP 413 status. It is also recommended to set timeouts and a header size limit in the HTTP server configuration to prevent similar issues.