Read the docs
TI-2026-74367 Aliases CVE-2026-108395

Memory exhaustion in Model Context Protocol Java SDK HTTP transports

Priority MEDIUM 40CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-770.

Summary

The io.modelcontextprotocol.sdk:mcp artifact is affected from 0.8.0 before 0.13.0, and mcp-core from 0.13.0 before 0.18.4, from 1.0.0 before 1.1.4, and from 2.0.0-M1 before 2.0.1. The Servlet-based SSE, Streamable HTTP and Stateless transports read request bodies into memory without a size limit (CWE-770). An unauthenticated remote client can stream an arbitrarily large POST body until the Java process exhausts its heap.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through 1.1.3 in io.modelcontextprotocol.sdk:mcp-core, and from mcp-core 2.0.0-M1 through 2.0.0, the Servlet-based SSE, Streamable HTTP, and Stateless server transports read an HTTP request body into memory without enforcing a maximum size. An unauthenticated remote client able to reach an affected transport can stream an arbitrarily large POST body, including with chunked transfer encoding, until the Java process exhausts its heap and becomes unavailable. Authentication, Origin or Host validation, or an upstream request-size limit can reject the request before the vulnerable read. The maintained mcp-core lines are fixed in versions 0.18.4, 1.1.4, and 2.0.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00608 49th percentileScored 2026-11-07
Fix Fixed io.modelcontextprotocol.sdk:mcp (modelcontextprotocol): 0.13.0io.modelcontextprotocol.sdk:mcp-core (modelcontextprotocol): 0.18.4, 1.1.4, 2.0.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MLflowio.modelcontextprotocol.sdk:mcp0.8.0 to before 0.13.00.13.0Patch availableCNA
MLflowio.modelcontextprotocol.sdk:mcp-core0.13.0 to before 0.18.4; 1.0.0 to before 1.1.4; 2.0.0-M1 to before 2.0.10.18.4, 1.1.4, 2.0.1Patch availableCNA
  • io.modelcontextprotocol.sdk:mcp VendorMLflow Affected 0.8.0 to before 0.13.0 Fixed in 0.13.0 Patch available CNA
  • io.modelcontextprotocol.sdk:mcp-core VendorMLflow Affected 0.13.0 to before 0.18.4; 1.0.0 to before 1.1.4; 2.0.0-M1 to before 2.0.1 Fixed in 0.18.4, 1.1.4, 2.0.1 Patch available CNA

Remediation

Update io.modelcontextprotocol.sdk:mcp to 0.13.0, and io.modelcontextprotocol.sdk:mcp-core to 0.18.4, 1.1.4 or 2.0.1.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA io.modelcontextprotocol.sdk:mcp (modelcontextprotocol) Fixed in 0.13.0
  • Fix · CNA io.modelcontextprotocol.sdk:mcp-core (modelcontextprotocol) Fixed in 0.18.4, 1.1.4, 2.0.1

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-15 Threatist record created from CVE-2026-108395
  2. 2026-10-16 Priority changed: LOW → MEDIUM
  3. 2026-11-06 Affected versions changed · Red Hat
  4. 2026-11-06 CVSS score added · Red Hat

References

Other 8

  • TI-2026-46366 Server-side request forgery in mlflow KEVCVSS 3.1CRITICAL 9.3
  • TI-2023-03518 Absolute Path Traversal in mlflow/mlflow CVSS 3.1CRITICAL 10.0
  • TI-2023-01113 Path Traversal: '\..\filename' in mlflow/mlflow CVSS 3.1CRITICAL 9.8
  • TI-2025-31759 Redis Lua Use-After-Free may lead to remote code execution CVSS 3.1CRITICAL 10.0
  • TI-2026-81527 Code execution via scorer deserialization in MLflow servers CVSS 3.1CRITICAL 9.8
  • TI-2025-14028 Command Injection in mlflow/mlflow CVSS 3.1CRITICAL 10.0
See all 175 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences