Executive brief
mcp-searxng is an MCP server that allows AI agents to fetch and read web content via the web_url_read tool. A remote attacker can force unbounded memory and CPU consumption by serving a web response without a Content-Length header, bypassing the tool's 5 MiB size limit and causing the server process to hang or crash, disrupting service availability for all users.
Technical details
This is an uncontrolled resource consumption (denial of service) vulnerability in the web_url_read MCP tool. The vulnerable code relies on a HEAD request to check the Content-Length header before fetching the full response body. However, when a server omits Content-Length—which is valid HTTP behavior—the checkContentLength() function returns null, causing the guard condition (contentLength !== null) to evaluate false and bypass the 5 MiB size check entirely. The subsequent GET request via response.text() then loads the unbounded response body into memory without any cap, amplified by CPU-intensive HTML-to-Markdown conversion. An unauthenticated attacker in HTTP transport mode (the default) can trigger this by supplying a URL to a malicious endpoint; in stdio mode, prompt injection can force the AI model to call the tool with an attacker-controlled URL. The vendor released patched version 1.7.1 addressing the issue by implementing streaming response reading with byte limits.
Affected products
- ihor-sokoliuk mcp-searxng <=1.6.0
Timeline
- 2026-06-18: disclosed
- 2026-06-19: patched: Version 1.7.1 released with streaming response reader fix