What happened
Verified via NVD REST API (published 2026-10-14, CVSS 7.5). The official Java SDK's Servlet-based SSE/Streamable HTTP/Stateless transports do not enforce a maximum HTTP request-body size; the advisory notes that upstream auth/Origin/Host validation or an external request-size limit can mitigate. Fixes shipped in mcp-core 0.18.4/1.1.4/2.0.1 (GHSA-4x8c-5vv7-973f).
Why it matters
MCP servers are the tool-execution surface of AI agents; a remote unauthenticated memory-exhaustion crash takes down every agent calling that server. This is the Java counterpart to a same-week cluster of official MCP SDK DoS advisories (Python SDK CVE-2026-109527, session-retention CVE-2026-59951, plus prior mcp-go/Kotlin SDK), showing a systematic gap across all official MCP SDK transport stacks — deployers should treat request-size limiting as an SDK-level requirement.
Attack vector
An unauthenticated remote client streams an arbitrarily large POST body (including chunked transfer-encoding) to an affected Java MCP transport, which reads the full body into memory with no size limit, exhausting the JVM heap and crashing the MCP server (CWE-770).
Affected systems
io.modelcontextprotocol.sdk:mcp-core 0.13.0–0.18.3, 1.0.0–1.1.3, 2.0.0-M1–2.0.0; io.modelcontextprotocol.sdk:mcp 0.8.0–0.12.0. Fixed in mcp-core 0.18.4, 1.1.4, 2.0.1.
Mitigation
Upgrade to mcp-core 0.18.4 / 1.1.4 / 2.0.1. Enforce an upstream request-size limit / reverse-proxy body limit and keep MCP endpoints behind authentication.