CVE-2026-108859

HighCVSS 7.5/10Last modified Oct 18, 2026

Description

mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that allows remote unauthenticated attackers to exhaust memory by sending oversized POST bodies. Attackers can send arbitrarily large or many concurrent POST requests, read fully via io.ReadAll before validation, to degrade or OOM-kill the server process.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-770

Affected software

No affected versions have been published.

Timeline

Published
Oct 11, 2026
Last modified
Oct 18, 2026
NVD status
Deferred

Related CVEs from 2026

CVE-2026-108869.6Use after free in FileSystem in Google Chrome prior to 149.0.7827.53 allowed a remote attacker to potentially perform a sandbox escape via aCVE-2026-1088609.1BotSharp through 5.2.0 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to forge bearer tokens uCVE-2026-1088614.3Odoo MCP 1.0.0 through 1.3.2 contains an information disclosure vulnerability that allows MCP clients to bypass the field-level ACL by invokCVE-2026-1088625.3APIPark through 1.9.7-beta contains an insecure direct object reference vulnerability that allows authenticated users to read other applicatCVE-2026-1088637.5Katanemo Plano through 0.4.37 contains a missing authentication vulnerability that allows unauthenticated network attackers to access the EnCVE-2026-1088644.2iFlytek Astron Agent through 1.1.2 contains an insecure direct object reference vulnerability that allows authenticated applications to resuCVE-2026-1088658.2AmoyLab Unla through 0.10.0 contains an authentication bypass vulnerability that allows unauthenticated attackers to obtain valid access tokCVE-2026-1088664.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows authenticated users to read any account's permissions viaCVE-2026-1088674.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController getUserRoleSetById handler that allows anyCVE-2026-1088684.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to publish templated system announCVE-2026-1088694.3JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to send system announcCVE-2026-108878.1Use after free in Chromoting in Google Chrome on Mac prior to 149.0.7827.53 allowed a remote attacker to execute arbitrary code via maliciou
CVE-2026-108859: High severity, CVSS 7.5 | Vulnix