CVE-2026-108395

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-108395
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108395.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-108395
Aliases
  • GHSA-4x8c-5vv7-973f
Published
2026-10-14T17:46:23Z
Modified
2026-10-15T10:30:44Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Model Context Protocol Java SDK HTTP server transports allow memory exhaustion through unbounded request bodies
Details

The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through 1.1.3 in io.modelcontextprotocol.sdk:mcp-core, and from mcp-core 2.0.0-M1 through 2.0.0, the Servlet-based SSE, Streamable HTTP, and Stateless server transports read an HTTP request body into memory without enforcing a maximum size. An unauthenticated remote client able to reach an affected transport can stream an arbitrarily large POST body, including with chunked transfer encoding, until the Java process exhausts its heap and becomes unavailable. Authentication, Origin or Host validation, or an upstream request-size limit can reject the request before the vulnerable read. The maintained mcp-core lines are fixed in versions 0.18.4, 1.1.4, and 2.0.1.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-770"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/108xxx/CVE-2026-108395.json"
}
References

Affected packages

Git / github.com/modelcontextprotocol/java-sdk

Affected ranges

Type
GIT
Repo
https://github.com/modelcontextprotocol/java-sdk
Events
Introduced
7be502fb6c9c9def055fd82d2319dfd13f080da1
Fixed
4b435d2c5f6f460880716db8ae40ed7dd0a35602
Introduced
4b435d2c5f6f460880716db8ae40ed7dd0a35602
Fixed
a710d973b699160b796397fe17f082e24c38e0b2
Introduced
3c87155b9ac11ab3f72dfc01d2238510537de69a
Fixed
8a7002f2cddd0a6f6e0d8d476feca2ce8ddd5db8
Introduced
46f95199f659841a3bac18d4706307caeb26a2c3
Fixed
c7e1cfe90edcd9cbe030924310a194dc5492eab2
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0.8.0"
        },
        {
            "fixed":  "0.13.0"
        },
        {
            "introduced":  "0.13.0"
        },
        {
            "fixed":  "0.18.4"
        },
        {
            "introduced":  "1.0.0"
        },
        {
            "fixed":  "1.1.4"
        },
        {
            "introduced":  "2.0.0-M1"
        },
        {
            "fixed":  "2.0.1"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-108395.json"