Memory Exhaustion Vulnerability in Model Context Protocol Python SDK

CVE-2026-109527

What is CVE-2026-109527?

The Model Context Protocol Python SDK, utilized for interacting with Model Context Protocol servers and clients, contains a critical vulnerability in versions prior to 1.29.1 and 2.0.0a1 through 2.0.1. The issue arises from the Streamable HTTP session manager and OAuth authorization-server routes which buffer HTTP request bodies without enforcing a maximum size limit. An unauthenticated remote client can exploit this flaw by sending exceedingly large request bodies, consuming significantly more memory than the original request size, potentially leading to server instability or crashes. Applications using StreamableHTTPServerTransport are advised to implement their own request size limits while standard SDK server applications have been updated in the latest versions to mitigate this risk.

References