CVE-2026-39313

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-39313", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-04-06T19:31:07.265Z", "datePublished": "2026-04-16T21:24:27.328Z", "dateUpdated": "2026-04-17T18:46:07.726Z"}, "containers": {"cna": {"title": "MCP-Framework: Unbounded memory allocation in readRequestBody allows denial of service via HTTP transport", "problemTypes": [{"descriptions": [{"cweId": "CWE-770", "lang": "en", "description": "CWE-770: Allocation of Resources Without Limits or Throttling", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/QuantGeekDev/mcp-framework/security/advisories/GHSA-353c-v8x9-v7c3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/QuantGeekDev/mcp-framework/security/advisories/GHSA-353c-v8x9-v7c3"}, {"name": "https://github.com/QuantGeekDev/mcp-framework/commit/f97d2bb76d6359faf10cd1fc54b4911476b62524", "tags": ["x_refsource_MISC"], "url": "https://github.com/QuantGeekDev/mcp-framework/commit/f97d2bb76d6359faf10cd1fc54b4911476b62524"}], "affected": [{"vendor": "QuantGeekDev", "product": "mcp-framework", "versions": [{"version": "< 0.2.22", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-16T21:24:27.328Z"}, "descriptions": [{"lang": "en", "value": "mcp-framework is a framework for building Model Context Protocol (MCP) servers. In versions 0.2.21 and below, the readRequestBody() function in the HTTP transport concatenates request body chunks into a string with no size limit. Although a maxMessageSize configuration value exists, it is never enforced in readRequestBody(). A remote unauthenticated attacker can crash any mcp-framework HTTP server by sending a single large POST request to /mcp, causing memory exhaustion and denial of service. This issue has been fixed in version 0.2.22."}], "source": {"advisory": "GHSA-353c-v8x9-v7c3", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-17T18:45:58.804862Z", "id": "CVE-2026-39313", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-17T18:46:07.726Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-39313", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-17T18:45:58.804862Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-17T18:46:03.911Z"}}], "cna": {"title": "MCP-Framework: Unbounded memory allocation in readRequestBody allows denial of service via HTTP transport", "source": {"advisory": "GHSA-353c-v8x9-v7c3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "QuantGeekDev", "product": "mcp-framework", "versions": [{"status": "affected", "version": "< 0.2.22"}]}], "references": [{"url": "https://github.com/QuantGeekDev/mcp-framework/security/advisories/GHSA-353c-v8x9-v7c3", "name": "https://github.com/QuantGeekDev/mcp-framework/security/advisories/GHSA-353c-v8x9-v7c3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/QuantGeekDev/mcp-framework/commit/f97d2bb76d6359faf10cd1fc54b4911476b62524", "name": "https://github.com/QuantGeekDev/mcp-framework/commit/f97d2bb76d6359faf10cd1fc54b4911476b62524", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "mcp-framework is a framework for building Model Context Protocol (MCP) servers. In versions 0.2.21 and below, the readRequestBody() function in the HTTP transport concatenates request body chunks into a string with no size limit. Although a maxMessageSize configuration value exists, it is never enforced in readRequestBody(). A remote unauthenticated attacker can crash any mcp-framework HTTP server by sending a single large POST request to /mcp, causing memory exhaustion and denial of service. This issue has been fixed in version 0.2.22."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-770", "description": "CWE-770: Allocation of Resources Without Limits or Throttling"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-16T21:24:27.328Z"}}}, "cveMetadata": {"cveId": "CVE-2026-39313", "state": "PUBLISHED", "dateUpdated": "2026-04-17T18:46:07.726Z", "dateReserved": "2026-04-06T19:31:07.265Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-16T21:24:27.328Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "mcp-framework", "vendor": "QuantGeekDev", "versions": [{"status": "affected", "version": "< 0.2.22"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "mcp-framework is a framework for building Model Context Protocol (MCP) servers. In versions 0.2.21 and below, the readRequestBody() function in the HTTP transport concatenates request body chunks into a string with no size limit. Although a maxMessageSize configuration value exists, it is never enforced in readRequestBody(). A remote unauthenticated attacker can crash any mcp-framework HTTP server by sending a single large POST request to /mcp, causing memory exhaustion and denial of service. This issue has been fixed in version 0.2.22."}, {"lang": "es", "value": "mcp-framework es un framework para construir servidores de Model Context Protocol (MCP). En las versiones 0.2.21 e inferiores, la funci\u00f3n readRequestBody() en el transporte HTTP concatena fragmentos del cuerpo de la solicitud en una cadena sin l\u00edmite de tama\u00f1o. Aunque existe un valor de configuraci\u00f3n maxMessageSize, nunca se aplica en readRequestBody(). Un atacante remoto no autenticado puede bloquear cualquier servidor HTTP de mcp-framework enviando una \u00fanica solicitud POST grande a /mcp, causando agotamiento de memoria y denegaci\u00f3n de servicio. Este problema ha sido solucionado en la versi\u00f3n 0.2.22."}], "id": "CVE-2026-39313", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-39313", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-17T18:45:58.804862Z", "version": "2.0.3"}}]}, "published": "2026-04-16T22:16:38.073", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/QuantGeekDev/mcp-framework/commit/f97d2bb76d6359faf10cd1fc54b4911476b62524"}, {"source": "security-advisories@github.com", "url": "https://github.com/QuantGeekDev/mcp-framework/security/advisories/GHSA-353c-v8x9-v7c3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-770"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,0.2.22)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "mcp-framework", "source": "cna", "vendor": "QuantGeekDev"}, "product": "mcp-framework", "vendor": "quantgeekdev"}], "analysis": {"en": {"generated_at": "2026-04-17T02:26:07.911548+00:00", "value": {"mitigation_remediation": ["Update the mcp-framework package to version 0.2.22 or newer to apply the official fix.", "Configure an upstream proxy or firewall (e.g., Nginx client_max_body_size or Apache LimitRequestBody) to enforce a maximum POST body size, reducing the risk of excessive memory usage.", "Set up monitoring and alerting for unusually large HTTP POST requests or rapid memory spikes on the server to detect and respond to attempted denial\u2011of\u2011service attacks."], "summary": {"action": "Patch Immediately", "impact": "Denial of Service via memory exhaustion"}, "threat_synthesis": {"affected_systems": "The affected product is QuantGeekDev\u2019s mcp-framework, specifically versions 0.2.21 and older. Any deployment of an MCP server built with these releases that exposes the HTTP transport is at risk. The defect was addressed in version 0.2.22.", "description_and_impact": "The vulnerability resides in the readRequestBody() function of the MCP-Framework, where request body fragments are concatenated into a string with no enforced size limit. This allows an unauthenticated attacker to send an excessively large POST payload to the /mcp endpoint, causing the server to consume growing amounts of memory until it crashes. The flaw results in a Denial of Service (DoS) condition that prevents legitimate clients from accessing the service.", "risk_and_exploitability": "The vulnerability scores a high CVSS score of 8.7 and is not listed in the CISA KEV catalog, indicating a serious condition but lacking evidence of active exploitation. The attack vector is straightforward: a single, unauthenticated HTTP POST request to /mcp with a very large body. Because no authentication or size checks are applied, exploitation requires only network connectivity to the server, making it highly feasible for remote attackers."}}}}, "created": "2026-04-17T02:30:07.315100+00:00", "updated": "2026-04-17T08:01:26.403112+00:00", "vendors": ["quantgeekdev", "quantgeekdev$PRODUCT$mcp-framework"]}