CVE-2026-109527: MCP Python SDK HTTP servers can be knocked offline with huge requests
MCP servers built with the official Python SDK read whole HTTP request bodies into memory with no size limit on the SSE message endpoint and OAuth routes. One large request can exhaust memory and take the server down, often with no login needed.
What it is
GitHub advisory: “One large request grew the process’s memory by two to three times the size of the body, so a client that could reach the server over HTTP could exhaust its memory and take it offline, repeatedly.”
No credentials are needed against the OAuth endpoints (/token, /register, /revoke, /authorize) or against a server that does not require authentication, which is the default.
1.29.0 and 2.0.0 capped only the Streamable HTTP endpoint at 4 MiB; 1.29.1 and 2.1.0 extend the cap to every HTTP endpoint.
How to check
- Affected: mcp (pip) below 1.29.1, and 2.0.0 to 2.0.1.
- Not affected: stdio-only servers, MCP clients, and servers behind a proxy that already caps request body size.
How to fix
- Upgrade mcp to 1.29.1 (1.x) or 2.1.0 (2.x). There is no fixed 2.0.x release.
- If you can’t upgrade yet, put a reverse proxy with a request body limit in front of the server.
pip show mcp | grep Version
pip install -U "mcp>=1.29.1"Sources
- criticalCVE-2026-96620: Claude Agent SDK (Python) resume option lets attackers run commands
- criticalCVE-2026-32871: FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability
- criticalCVE-2025-6514: mcp-remote exposed to OS command injection via untrusted MCP server connections
- criticalCVE-2025-49596: MCP Inspector proxy server lacks authentication between the Inspector client and proxy