https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 12 Oct 2026 22:20:08 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-291848 EUVD-2026-291848 https://cve.radiocsirt.org/vuln/euvd-2026-291848 https://cve.radiocsirt.org/vuln/fkie_cve-2026-39313 <p>mcp-framework is a framework for building Model Context Protocol (MCP) servers. In versions 0.2.21 and below, the readRequestBody() function in the HTTP transport concatenates request body chunks into a string with no size limit. Although a maxMessageSize configuration value exists, it is never enforced in readRequestBody(). A remote unauthenticated attacker can crash any mcp-framework HTTP server by sending a single large POST request to /mcp, causing memory exhaustion and denial of service. This issue has been fixed in version 0.2.22.</p> <p>mcp-framework is a framework for building Model Context Protocol (MCP) servers. In versions 0.2.21 and below, the readRequestBody() function in the HTTP transport concatenates request body chunks into a string with no size limit. Although a maxMessageSize configuration value exists, it is never enforced in readRequestBody(). A remote unauthenticated attacker can crash any mcp-framework HTTP server by sending a single large POST request to /mcp, causing memory exhaustion and denial of service. This issue has been fixed in version 0.2.22.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-39313 https://cve.radiocsirt.org/vuln/ghsa-353c-v8x9-v7c3 <p><strong>Affected:</strong> npm: mcp-framework</p> <p>### Summary</p> <p>The `readRequestBody()` function in `src/transports/http/server.ts` concatenates HTTP request body chunks into a string with no size limit, allowing a remote unauthenticated attacker to crash the server via memory exhaustion with a single large HTTP POST request.</p> <p>### Details</p> <p>**File:** `src/transports/http/server.ts`, lines 224-240</p> <p>```typescript private async readRequestBody(req: IncomingMessage): Promise&lt;any&gt; { return new Promise((resolve, reject) =&gt; { let body = &#39;&#39;; req.on(&#39;data&#39;, (chunk) =&gt; { body += chunk.toString(); // No size limit }); req.on(&#39;end&#39;, () =&gt; { try { const parsed = body ? JSON.parse(body) : null; resolve(parsed); } catch (error) { reject(error); } }); req.on(&#39;error&#39;, reject); }); } ```</p> <p>A `maxMessageSize` configuration value exists in `DEFAULT_HTTP_STREAM_CONFIG` (4MB, defined in `src/transports/http/types.ts` line 124) but is never enforced in `readRequestBody()`. This creates a false sense of security.</p> <p>### PoC</p> <p>Local testing with 50MB POST payloads against the vulnerable `readRequestBody()` function:</p> <p>| Trial | Payload | RSS growth | Time | Result | |-------|---------|-----------|------|--------| | 1 | 50MB | +197MB | 42ms | Vulnerable | | 2 | 50MB | +183MB | 46ms | Vulnerable | | 3 | 50MB | +15MB | 43ms | Vulnerable | | 4 | 50MB | +14MB | 32ms | Vulnerable | | 5 | 50MB | +65MB | 38ms | Vulnerable |</p> <p>Reproducibility: 5/5 (100%)</p> <p>#…</p> <p><strong>Affected:</strong> npm: mcp-framework</p> <p>### Summary</p> <p>The `readRequestBody()` function in `src/transports/http/server.ts` concatenates HTTP request body chunks into a string with no size limit, allowing a remote unauthenticated attacker to crash the server via memory exhaustion with a single large HTTP POST request.</p> <p>### Details</p> <p>**File:** `src/transports/http/server.ts`, lines 224-240</p> <p>```typescript private async readRequestBody(req: IncomingMessage): Promise&lt;any&gt; { return new Promise((resolve, reject) =&gt; { let body = &#39;&#39;; req.on(&#39;data&#39;, (chunk) =&gt; { body += chunk.toString(); // No size limit }); req.on(&#39;end&#39;, () =&gt; { try { const parsed = body ? JSON.parse(body) : null; resolve(parsed); } catch (error) { reject(error); } }); req.on(&#39;error&#39;, reject); }); } ```</p> <p>A `maxMessageSize` configuration value exists in `DEFAULT_HTTP_STREAM_CONFIG` (4MB, defined in `src/transports/http/types.ts` line 124) but is never enforced in `readRequestBody()`. This creates a false sense of security.</p> <p>### PoC</p> <p>Local testing with 50MB POST payloads against the vulnerable `readRequestBody()` function:</p> <p>| Trial | Payload | RSS growth | Time | Result | |-------|---------|-----------|------|--------| | 1 | 50MB | +197MB | 42ms | Vulnerable | | 2 | 50MB | +183MB | 46ms | Vulnerable | | 3 | 50MB | +15MB | 43ms | Vulnerable | | 4 | 50MB | +14MB | 32ms | Vulnerable | | 5 | 50MB | +65MB | 38ms | Vulnerable |</p> <p>Reproducibility: 5/5 (100%)</p> <p>#…</p> https://cve.radiocsirt.org/vuln/ghsa-353c-v8x9-v7c3