CyberRota Analysis
AI-GeneratedThe HTTP handler component of Google mcp-toolbox versions up to 1.4.0 is vulnerable to a denial of service (DoS) attack due to unrestricted resource allocation, allowing unauthenticated attackers to exploit this by sending a single large HTTP request. This can lead to excessive memory consumption, ultimately causing the application to crash from an Out-Of-Memory (OOM) error. Organizations using affected versions should prioritize remediation to prevent potential service disruptions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
An allocation of resources without limits vulnerability in the HTTP handler component of Google mcp-toolbox versions up to and including 1.4.0 allows an unauthenticated attacker to cause a denial of service (DoS). The /mcp endpoint handler reads incoming payloads directly into system memory using an unrestricted buffer loop (io.ReadAll) without applying defensive constraints such as http.MaxBytesReader or pre-read Content-Length enforcement. By submitting a single, massive HTTP request body, an attacker can linearly consume available host memory until the runtime process is terminated by an Out-Of-Memory (OOM) error.
Related CVEs
Other vulnerabilities affecting the same vendor(s)