CVE-2026-14539

Name of the Vulnerable Software and Affected Versions Google mcp-toolbox versions prior to 1.4.1

Description A resource allocation issue in the HTTP handler component allows an unauthenticated attacker to cause a denial of service (DoS). The '/mcp' endpoint handler reads incoming payloads directly into system memory using an unrestricted buffer loop io.ReadAll() without applying defensive constraints like http.MaxBytesReader or pre-read Content-Length enforcement. An attacker can consume available host memory by submitting a single, massive HTTP request body until the process is terminated by an Out-Of-Memory (OOM) error, which occurs when the system cannot allocate more memory to the process.

Recommendations Update to a version newer than 1.4.0. As a temporary mitigation, restrict access to the '/mcp' endpoint to trusted sources only.