Executive brief
The rmcp library's Streamable HTTP server transport (used in IDEs and local agents to expose Model Context Protocol functionality) contains a memory leak that allows any unauthenticated attacker on the same network to exhaust the server's RAM. By sending specially crafted requests, an attacker forces the server to permanently retain session objects that should be cleaned up, accumulating 400–550 bytes per request. At the demonstrated rate of 2,000+ requests per second from a single client, the server would consume 84 GB of memory in a single day before crashing, while also slowing down legitimate users through internal lock contention.
Technical details
The vulnerability is a resource exhaustion flaw in `StreamableHttpService::handle_post` (crates/rmcp/src/transport/streamable_http_server/tower.rs). The root cause is an order-of-operations bug: the handler calls `session_manager.create_session()` to allocate a `LocalSessionHandle` and insert it into a shared `HashMap`, then immediately validates the incoming request body. If validation fails (e.g., the request is not an `InitializeRequest`), the function returns early without ever calling `close_session()`. The allocated `LocalSessionHandle` and its associated tokio mpsc channel remain in the `LocalSessionManager.sessions` HashMap indefinitely because cleanup only occurs in two code paths: the success case (which is never reached on validation failure) and explicit HTTP DELETE requests. The attack is network-reachable without authentication on default configurations, since the default `allowed_hosts` accepts loopback traffic and any co-resident process qualifies as an attacker. Performance is further degraded because all session operations require acquiring a `RwLock` over the growing HashMap, causing write-lock starvation for legitimate clients. Patched in version 2.0.0.
Affected products
- modelcontextprotocol rmcp < 2.0.0
Timeline
- 2026-06-29: disclosed: Published as GHSA-9pj6-vhgr-3mwh
- 2026-09-16: advisory
- 2026-09-16: patched: Fixed in version 2.0.0