SB20261109195 - Allocation of Resources Without Limits or Throttling in MCP Python SDK

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261109195

SB20261109195 - Allocation of Resources Without Limits or Throttling in MCP Python SDK

Published: November 9, 2026

Security Bulletin ID SB20261109195
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 vulnerability.


1) Allocation of Resources Without Limits or Throttling (CVE-ID: CVE-2026-109527)

CWE-ID: CWE-770 - Allocation of Resources Without Limits or Throttling

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows an unauthenticated remote attacker to exhaust an MCP Python SDK server's memory and take it offline.

The vulnerability exists due to unbounded request body buffering in HTTP transports and OAuth endpoints when processing oversized requests. An unauthenticated remote attacker can send a large request to a reachable OAuth endpoint or a server using default unauthenticated access, causing repeated denial of service where no upstream request size limit applies.


Remediation

Install update from vendor's website.

References