Resource Exhaustion

The official MCP PHP SDK contains a flaw where its HTTP transport buffers Server-Sent Events data without any size limit, waiting indefinitely for a delimiter that a malicious server can simply withhold. A hostile or compromised MCP server (or a man-in-the-middle) can exploit this to crash or hang any connecting PHP-based MCP client through memory exhaustion, with no authentication or user interaction required.

Updated Aug 26, 2026

This is a research paper describing a defensive framework (AEGIS), not an active exploit or newly disclosed vulnerability. It highlights a known class of risk where MCP agents can request excessive resources (e.g., huge search radii, long videos) across multiple modalities, potentially degrading service, and proposes a policy-enforcement layer to mitigate it.

Updated Aug 24, 2026

Spring AI's MCP Streamable HTTP server transport (WebFlux/WebMvc) fails to limit or authenticate sessions, allowing a remote unauthenticated attacker to open unbounded sessions until the server exhausts memory and crashes. This is a straightforward denial-of-service issue rather than an agent-logic compromise, but it can take down MCP-based agent infrastructure for all legitimate clients.

Updated Aug 21, 2026 · CVSS 7.5

The official MCP Ruby SDK contained a flaw where its HTTP transport read entire JSON-RPC request bodies into memory without any size limit. An unauthenticated remote attacker could send oversized POST requests to exhaust server memory and crash the MCP server, disrupting all agents relying on it. This is fixed in version 0.23.0.

Updated Jul 30, 2026 · CVSS 7.5

The official MCP Ruby SDK fails to expire sessions in its StreamableHTTPTransport, allowing an attacker to repeatedly send initialize requests and accumulate ServerSession objects indefinitely. This can exhaust server memory and cause a denial of service against any MCP server built on this SDK. The issue is fixed in version 0.23.0.

Updated Jul 30, 2026 · CVSS 5.3

The official MCP Ruby SDK (versions prior to 0.23.0) contains a denial-of-service vulnerability where its stdio transport reads input without a byte limit. A malicious peer (client or server) connected over stdio can send data without a newline terminator to exhaust the host process's memory, crashing or degrading the MCP server or client. This is a straightforward availability issue, not a code-execution or data-exfiltration flaw, and is fixed in 0.23.0.

Updated Jul 30, 2026 · CVSS 6.2

GitHub's official MCP Server contains a bug where a malformed 'completion/complete' JSON-RPC request with a missing 'ref' field crashes the server via a nil pointer dereference. Because the crash happens before authentication, any unauthenticated client that can reach the server can take it offline. This is a straightforward availability issue rather than a data breach or code execution flaw.

Updated Jul 28, 2026 · CVSS 7.5

An authenticated n8n user can repeatedly abuse the data-table file upload endpoint to bypass per-request quota checks, causing temporary files to accumulate on disk faster than cleanup can remove them. This can exhaust host disk space, leading to a denial-of-service condition affecting the n8n instance and potentially other services on the same host. This is a genuine, moderate-severity resource exhaustion flaw rather than a novel agentic-AI attack, but it is directly relevant to n8n's growing role as an orchestration layer for AI agent workflows.

Updated Jul 23, 2026