Threat
The first of its kind: how one unbounded request body became a denial-of-service class across every major MCP SDK
Publication date unknown · Discovered dev.to
Page published
Publication date unknown · First observed: 3 Nov 2026
Coverage timeline
Single-source analysis — one report is available.
Why it matters
Unbounded buffering in MCP implementations can let an unauthenticated attacker take agent tooling offline, making SDK updates and enforced request-size limits important defensive controls.
The article describes an unauthenticated denial-of-service class in MCP frameworks and SDKs: unbounded HTTP request-body reads can exhaust server memory before authentication. It identifies CVE-2026-39313 in mcp-framework versions through 0.2.21, fixed in 0.2.22, and reports related request-body and client-side SSE-buffering fixes across other MCP implementations.