CVE-2026-108395: Model Context Protocol Java SDK HTTP server transports allow memory exhaustion through unbounded request bodies
The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through 1.1.3 in io.modelcontextprotocol.sdk:mcp-core, and from mcp-core 2.0.0-M1 through 2.0.0, the Servlet-based SSE, Streamable HTTP, and Stateless server transports read an HTTP request body into memory without enforcing a maximum size. An unauthenticated remote client able to reach an affected transport can stream an arbitrarily large POST body, including with chunked transfer encoding, until the Java process exhausts its heap and becomes unavailable. Authentication, Origin or Host validation, or an upstream request-size limit can reject the request before the vulnerable read. The maintained mcp-core lines are fixed in versions 0.18.4, 1.1.4, and 2.0.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
io.modelcontextprotocol.sdk:mcp-coreto a version that resolves this vulnerability.Fixed in 0.18.4 - Upgrade
Upgrade
io.modelcontextprotocol.sdk:mcp-coreto a version that resolves this vulnerability.Fixed in 1.1.4 - Upgrade
Upgrade
io.modelcontextprotocol.sdk:mcp-coreto a version that resolves this vulnerability.Fixed in 2.0.1 - Compensating control
Require authentication, validate the Origin or Host header, or enforce an upstream request-size limit before the request reaches the vulnerable transport read.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using the Servlet-based SSE, Streamable HTTP, or Stateless server transports in the affected mcp or mcp-core version ranges are exposed if an unauthenticated remote client can reach the transport. Other transport types are not identified in the available information.
What does an attacker need to do to cause an outage?
An attacker needs network access to an affected HTTP transport and can send an arbitrarily large POST request body, including through chunked transfer encoding. The server reads the body into memory without a maximum-size limit, potentially exhausting the Java heap and making the process unavailable.
Are deployments protected by authentication or request filtering?
Authentication, Origin or Host validation, or an upstream request-size limit can protect a deployment when they reject the request before the vulnerable body read occurs. The available information does not establish that any of these controls are enabled by default.
What can be done if an upgrade cannot be applied immediately?
Configure an upstream request-size limit that rejects oversized requests before they reach the affected transport. Restrict unauthenticated remote access and ensure authentication or Origin/Host validation rejects requests before the vulnerable read where applicable.
Which versions contain fixes?
The maintained mcp-core release lines are fixed in versions 0.18.4, 1.1.4, and 2.0.1. The provided information does not identify a fixed version for the older io.modelcontextprotocol.sdk:mcp artifact.