CVE-2026-109527

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP...

CVE-2026-109527 Model Context Protocol Python SDK HTTP and OAuth endpoints allow memory exhaustion through unbounded request bodies

The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients. In mcp versions before 1.29.1 and from 2.0.0a1 through 2.0.1, the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP...

CVE-2026-108395 Model Context Protocol Java SDK HTTP server transports allow memory exhaustion through unbounded request bodies

The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through 1.1.3 in io.modelcontextprotocol.sdk:mcp-core, and from...

EUVD-2026-101503

The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through 1.1.3 in io.modelcontextprotocol.sdk:mcp-core, and from...

CVE-2026-108395

The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through 1.1.3 in io.modelcontextprotocol.sdk:mcp-core, and from...

CVE-2026-108395 Model Context Protocol Java SDK HTTP server transports allow memory exhaustion through unbounded request bodies

The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through 1.1.3 in io.modelcontextprotocol.sdk:mcp-core, and from...

CVE-2026-108395 Model Context Protocol Java SDK HTTP server transports allow memory exhaustion through unbounded request bodies

The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through 1.1.3 in io.modelcontextprotocol.sdk:mcp-core, and from...

CVE-2026-92392

A flaw was found in curl. When curl uploads data over an HTTP/2 connection, it mishandles server stream reset frames, which can lead to the reuse of previously released memory. Under specific memory and timing conditions, a malicious server can exploit this flaw to execute arbitrary code on the...

CVE-2026-59951

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol MCP. From 1.8.0 until 1.30.0 and 2.2.0, stateful Streamable HTTP servers, including FastMCP, MCPServer, Server.streamablehttpapp, and StreamableHTTPSessionManager, retain session entries without an id...

CVE-2026-105659

Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOWUPDATE frames. A stream whose response outruns the connection or stream send window blocks until the peer grants mor...

CVE-2026-105659 HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in Bandit

Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOWUPDATE frames. A stream whose response outruns the connection or stream send window blocks until the peer grants mor...

EEF-CVE-2026-105659 HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in Bandit

Summary Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOWUPDATE frames. A stream whose response outruns the connection or stream send window blocks until the peer...

EUVD-2026-101380

Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOWUPDATE frames. A stream whose response outruns the connection or stream send window blocks until the peer grants mor...

CVE-2026-105659

The mtrudel bandit library (version 1.4.0 and onward) is vulnerable to an Uncontrolled Resource Consumption vulnerability. An unauthenticated remote attacker can pin HTTP/2 stream processes indefinitely by sending a trickle of small WINDOW_UPDATE frames. The root cause is that the Bandit.HTTP2.Co...

CVE-2026-105659 HTTP/2 blocked-send deadlines reset on every WINDOW_UPDATE, letting a trickle pin stream processes indefinitely in Bandit

Uncontrolled Resource Consumption vulnerability in mtrudel bandit allows an unauthenticated remote attacker to pin HTTP/2 stream processes indefinitely via a trickle of small WINDOWUPDATE frames. A stream whose response outruns the connection or stream send window blocks until the peer grants mor...

CVE-2026-59951

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol MCP. From 1.8.0 until 1.30.0 and 2.2.0, stateful Streamable HTTP servers, including FastMCP, MCPServer, Server.streamablehttpapp, and StreamableHTTPSessionManager, retain session entries without an id...

CVE-2026-91881

Dell Terraform Provider for Redfish, versions prior to 1.6.2, contains an Improper Certificate Validation vulnerability in the HTTP transport component. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to information exposure and unauthorized...

DEBIAN-CVE-2026-95101

Description NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with proxyrequestbuffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vulnerability may allow remote attackers to inject...

AZL-108449 CVE-2026-95101 affecting package nginx 1.30.4-1

Description NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with proxyrequestbuffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vulnerability may allow remote attackers to inject...

CVE-2026-95101

Description NGINX Plus and NGINX Open Source have a vulnerability in the ngxhttpv3module module. When using HTTP/3 with proxyrequestbuffering on directive, an unauthenticated attacker may be able to inject data in the proxied request. Impact This vulnerability may allow remote attackers to inject...