Executive brief
Google mcp-toolbox, a set of tools for the Model Context Protocol, is vulnerable to a denial-of-service attack. An unauthenticated attacker can send a single, specially crafted large request that consumes all available system memory. This can cause the application to crash, leading to service outages and impacting operational availability.
Technical details
The vulnerability exists in the /mcp endpoint handler of Google mcp-toolbox due to the use of an unrestricted buffer loop (io.ReadAll) when reading incoming HTTP payloads. The component fails to implement defensive constraints such as http.MaxBytesReader or Content-Length enforcement. A remote, unauthenticated attacker can exploit this by submitting a massive HTTP request body, leading to linear memory consumption and an eventual Out-Of-Memory (OOM) termination of the process. The issue is addressed in pull request #3216 by implementing a 10 MiB limit using http.MaxBytesReader.
Affected products
- Google mcp-toolbox up to and including 1.4.0
Timeline
- 2026-05-12: patched: Fix submitted via Pull Request #3216
- 2026-07-31: advisory: NVD publication date