Resource Limitation Flaw in Google mcp-toolbox Allows DoS Attack

CVE-2026-14539

What is CVE-2026-14539?

A vulnerability exists in the HTTP handler component of Google mcp-toolbox, where resource allocation is not limited, enabling an unauthenticated attacker to trigger a denial of service (DoS). This occurs through the /mcp endpoint handler, which processes incoming payloads directly into system memory without enforced constraints. Attackers can submit a massive HTTP request body, leading to excessive memory consumption that ultimately causes the runtime process to crash due to an Out-Of-Memory (OOM) error.

References