What happened
Verified via NVD REST API (both published 2026-10-14; CVE-2026-109527 CVSS 7.5 CWE-770; CVE-2026-59951 CVSS 6.9 v4.0 CWE-400/772). Two distinct resource-exhaustion flaws in the official Python MCP SDK stream transports, fixed in independent patch lines. Stdio-only deployments and servers behind an upstream body-size limit are not affected.
Why it matters
Together with the same-week Java SDK advisory and the prior mcp-go/Kotlin SDK advisories, this shows the official MCP SDK HTTP transports broadly lack request-size and session-lifecycle limits — a remote, unauthenticated way to take down agent tool servers that powers many AI workflows. Agent platforms should enforce body-size and session limits at their ingress regardless of SDK patches.
Attack vector
Unauthenticated remote client sends a large declared or streamed request body to the Streamable HTTP session manager, SSE message endpoint, or OAuth authorization-server route; the endpoint buffers the body (consuming multiple times the body size in memory) to exhaust or kill the server. Separately (CVE-2026-59951), stateful Streamable HTTP servers never expire or cap session entries, so ordinary short requests grow server memory without bound until restart.
Affected systems
mcp < 1.29.1 and 2.0.0a1–2.0.1 for CVE-2026-109527; mcp 1.8.0–1.30.0 and 2.0.0–2.2.0 for the session-retention DoS CVE-2026-59951. Fixed in 1.29.1/2.1.0 (109527) and 1.30.0/2.2.0 (59951).
Mitigation
Upgrade mcp to >= 1.29.1 (or 2.1.0) and >= 1.30.0/2.2.0 for the session-retention fix. Add reverse-proxy request-size limits and session management at the deployment edge.