CVE-2026-109527

{
  "etk_id": "ETK-2026-154",
  "cve_id": "CVE-2026-109527",
  "display_id": "CVE-2026-109527",
  "ghsa_id": "GHSA-fmmv-w9g8-j3gc",
  "euvd_id": "EUVD-2026-101514",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unbounded HTTP request-body buffering in mcp",
  "summary": "The Python `mcp` SDK is affected when an HTTP server uses versions before 1.29.1 in the 1.x line or 2.0.0 through 2.0.1. An unauthenticated client that can reach affected HTTP, SSE, or OAuth routes can cause excessive memory consumption and disrupt the server by submitting an oversized request. Stdio-only servers and deployments with an effective upstream request-body limit are not affected.",
  "mitigation": "Upgrade `mcp` to 1.29.1 or later on the 1.x line, or 2.1.0 or later on the 2.x line. Until upgraded, enforce request-body size limits in a reverse proxy or ASGI middleware; directly used `StreamableHTTPServerTransport` instances must apply their own limit.",
  "vendor": "pip",
  "product": "pip:mcp",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "< 1.29.1"
      ],
      "ecosystem": "pip",
      "fixed_versions": [
        "1.29.1"
      ],
      "package_name": "mcp",
      "purl": "pkg:pypi/mcp"
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= 2.0.0, < 2.1.0"
      ],
      "ecosystem": "pip",
      "fixed_versions": [
        "2.1.0"
      ],
      "package_name": "mcp",
      "purl": "pkg:pypi/mcp"
    }
  ],
  "cwes": [
    770
  ],
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": 0.007,
  "epss_percentile": 0.5235,
  "epss_asof": "2026-10-20",
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 26.19307225,
  "t0_at": "2026-10-14T17:52:35.943000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-09-30T20:53:39+00:00",
      "days": -13.87427017361111,
      "is_lower_bound": false,
      "measured_at": "2026-10-14T17:52:35.943000+00:00",
      "url": "https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-fmmv-w9g8-j3gc"
    }
  }
}