CVE-2026-109527 Model Context Protocol Python SDK HTTP and OAuth endpoints allow memory exhaustion through unbounded request bodies

🗓️ 14 Oct 2026 17:52:35Reported by GoogleType

osv_cve🔗 osv.dev👁 9 Views

Unauthenticated remote DoS in Model Context Protocol Python SDK via unbounded request bodies.

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2026-109527	14 Oct 202623:22	–	circl
CVE	CVE-2026-109527	14 Oct 202617:52	–	cve
Cvelist	CVE-2026-109527 Model Context Protocol Python SDK HTTP and OAuth endpoints allow memory exhaustion through unbounded request bodies	14 Oct 202617:52	–	cvelist
Debian CVE	CVE-2026-109527	14 Oct 202617:52	–	debiancve
EUVD	EUVD-2026-101514	14 Oct 202617:52	–	euvd
Mend	CVE-2026-109527	14 Oct 202617:52	–	mend
NVD	CVE-2026-109527	14 Oct 202618:17	–	nvd
Positive Technologies	PT-2026-114020	14 Oct 202600:00	–	ptsecurity
Rapid7 Vulnerability Database (full)	CVE-2026-109527: Allocation of Resources Without Limits or Throttling	14 Oct 202600:00	–	rapid7
RedhatCVE	CVE-2026-109527	14 Oct 202618:50	–	redhatcve

Source	Link
github	www.github.com/modelcontextprotocol/python-sdk/releases/tag/v1.29.1
github	www.github.com/modelcontextprotocol/python-sdk/releases/tag/v2.1.0
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2026/109xxx/CVE-2026-109527.json
github	www.github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-fmmv-w9g8-j3gc
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-109527
github	www.github.com/modelcontextprotocol/python-sdk/commit/03aaebd3aadb2567878dd811cb1f141454e8a080
github	www.github.com/modelcontextprotocol/python-sdk/commit/4dc224fab201bdef2fd5a065976b7ca31420187c
github	www.github.com/modelcontextprotocol/python-sdk/commit/57394b0548d1e2dc2dce8d67d84985769df3b8bb
github	www.github.com/modelcontextprotocol/python-sdk/commit/5f0b6af9f2b0aad3be3ba5cbfe80a9e4ea32e189

16 Oct 2026 02:47Current

6.1Medium risk

Vulners AI Score6.1

CVSS 3.17.5

EPSS0.007

Model Context Protocol Python SDK memory exhaustion DoS HTTP OAuth Streamable HTTP session manager