Executive brief
The mcp-searxng server, which allows AI agents to interact with the SearXNG search engine, contains a flaw that can be used to crash the service. By providing a specially crafted web link that does not specify its file size, an attacker can force the server to download an infinitely large file. This exhausts the server's memory and processing power, making it unavailable to legitimate users.
Technical details
The 'web_url_read' MCP tool in mcp-searxng enforces a 5 MiB response-size limit by checking the 'Content-Length' header of a preliminary HEAD request. However, the 'checkContentLength()' function returns null if the header is missing, causing the size-limit guard to short-circuit and evaluate as false. Consequently, the subsequent GET request uses 'response.text()' to load the entire response body into memory without any byte cap. This unbounded read, followed by CPU-intensive HTML-to-Markdown conversion via 'NodeHtmlMarkdown.translate()', allows an unauthenticated remote attacker to trigger a Denial of Service (DoS) through resource exhaustion. The vulnerability is patched in version 1.7.1 by implementing a streaming reader with a hard byte limit.
Affected products
- ihor-sokoliuk mcp-searxng < 1.7.1
Timeline
- 2026-06-18: disclosed
- 2026-06-18: advisory
- 1.7.1: patched