High severity7.5NVD Advisory· Published Oct 11, 2026· Updated Oct 11, 2026

CVE-2026-108859

Description

mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that allows remote unauthenticated attackers to exhaust memory by sending oversized POST bodies. Attackers can send arbitrarily large or many concurrent POST requests, read fully via io.ReadAll before validation, to degrade or OOM-kill the server process.

Affected products

Mark3labs/Mcp Gollm-fuzzy
Range: <=1.2.1

Patches

Vulnerability mechanics

References

github.com/mark3labs/mcp-go/blob/90d247ed8d45cbb7d71d9a95e112789b78760443/server/streamable_http.gonvd
hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/mark3labs-mcp-go-streamable-http-unbounded-bodynvd
www.vulncheck.com/advisories/mcp-go-through-1.2.1-denial-of-service-via-unbounded-post-body-bufferingnvd

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000