CVE-2026-108395

The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through 1.1.3 in io.modelcontextprotocol.sdk:mcp-core, and from...

cn.net.pap.example:pap4j-boot3-example-spring-ai (0.0.4), com.embabel.agent:embabel-agent-a2a (>=0.5.0, <=1.0.0) +298 more potentially affected by CVE-2026-108395 via io.modelcontextprotocol.sdk:mcp-core (>=0.18.0, <=0.18.3)

io.modelcontextprotocol.sdk:mcp-core MAVEN version =0.18.0, =0.5.0, =0.5.0, =0.5.0, =1.0.0-rc1, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =0.5.0, =1.0.0 and more Source cves: CVE-2026-108395 Source advisory: MEND:CVE-2026-108395...

CVE-2026-108395

The Model Context Protocol Java SDK is vulnerable to memory exhaustion due to unbounded request bodies in certain server transports. Specifically, the Servlet-based SSE , Streamable HTTP , and Stateless server transports fail to enforce a maximum size when reading HTTP request bodies into memory....

EUVD-2026-101503

The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through 1.1.3 in io.modelcontextprotocol.sdk:mcp-core, and from...

PT-2026-114013

The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through 1.1.3 in io.modelcontextprotocol.sdk:mcp-core, and from...

CVE-2026-108395: Allocation of Resources Without Limits or Throttling

The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients. From version 0.8.0 through 0.12.0 in the io.modelcontextprotocol.sdk:mcp artifact, from 0.13.0 through 0.18.3 and 1.0.0 through 1.1.3 in io.modelcontextprotocol.sdk:mcp-core, and from...

CVE-2026-43995

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, multiple tool implementations directly import and invoke raw HTTP clients node-fetch, axios instead of using the secured wrapper. These tools include 1 OpenAPIToolkit/OpenAPIToolkit.ts, 2...

CVE-2026-43995 Flowise: SSRF Protection Bypass via Direct node-fetch / axios Usage (Patch Enforcement Failure)

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, multiple tool implementations directly import and invoke raw HTTP clients node-fetch, axios instead of using the secured wrapper. These tools include 1 OpenAPIToolkit/OpenAPIToolkit.ts, 2...

com.chinagoods.framework.thinkcloud:think-cloud-starter-ai-agentscope (>=4.4.0, <=4.4.2), com.chinagoods.framework.thinkcloud:think-cloud-starter-ai-dashscope (>=4.4.0, <=4.4.2) +104 more potentially affected by CVE-2026-35568 via io.modelcontextprotocol.sdk:mcp-core (0.17.2)

io.modelcontextprotocol.sdk:mcp-core MAVEN version 0.17.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.modelcontextprotocol.sdk:mcp-core and may be impacted: - com.chinagoods.framework.thinkcloud:think-cloud-starter-ai-agentscope =4.4.0, =4.4.0,...

io.github.gabrielbbaldez:notify-mcp (>=0.6.0, <=1.1.0), io.modelcontextprotocol.sdk:mcp (0.18.1) +7 more potentially affected by CVE-2026-35568 via io.modelcontextprotocol.sdk:mcp-core (0.18.1)

io.modelcontextprotocol.sdk:mcp-core MAVEN version 0.18.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.modelcontextprotocol.sdk:mcp-core and may be impacted: - io.github.gabrielbbaldez:notify-mcp =0.6.0, =1.1.0 - io.modelcontextprotocol.sdk:mcp...

com.linecorp.armeria:armeria-ai-mcp (1.37.0), io.github.gabrielbbaldez:notify-mcp (>=0.5.0, <=0.5.1) +7 more potentially affected by CVE-2026-35568 via io.modelcontextprotocol.sdk:mcp-core (0.18.0)

io.modelcontextprotocol.sdk:mcp-core MAVEN version 0.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.modelcontextprotocol.sdk:mcp-core and may be impacted: - com.linecorp.armeria:armeria-ai-mcp 1.37.0 - io.github.gabrielbbaldez:notify-mcp =0.5....

com.foggysource:foggy-chart-storage-cloud (>=8.1.1-beta, <=9.3.0), com.foggysource:foggy-dataset-mcp (>=8.1.1-beta, <=9.3.0) +25 more potentially affected by CVE-2026-35568 via io.modelcontextprotocol.sdk:mcp-core (0.13.1)

io.modelcontextprotocol.sdk:mcp-core MAVEN version 0.13.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.modelcontextprotocol.sdk:mcp-core and may be impacted: - com.foggysource:foggy-chart-storage-cloud =8.1.1-beta, =8.1.1-beta, =8.1.1-beta,...

cc.zzzyu.nacos:nacos-console (3.1.1), io.agentscope.examples:advanced (1.0.3) +53 more potentially affected by CVE-2026-35568 via io.modelcontextprotocol.sdk:mcp-core (0.14.1)

io.modelcontextprotocol.sdk:mcp-core MAVEN version 0.14.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.modelcontextprotocol.sdk:mcp-core and may be impacted: - cc.zzzyu.nacos:nacos-console 3.1.1 - io.agentscope.examples:advanced 1.0.3 -...

com.decathlon.tzatziki:tzatziki-test-mcp (>=2.3.10, <=2.4.3), com.infobip.kafkistry:kafkistry-app (>=0.9.9, <=0.10.2) +25 more potentially affected by CVE-2026-35568 via io.modelcontextprotocol.sdk:mcp-core (0.17.1)

io.modelcontextprotocol.sdk:mcp-core MAVEN version 0.17.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.modelcontextprotocol.sdk:mcp-core and may be impacted: - com.decathlon.tzatziki:tzatziki-test-mcp =2.3.10, =0.9.9, =0.9.9, =8.9.0-alpha4-rc1,...

cn.net.pap.example:pap4j-boot3-example-spring-ai (0.0.4), com.embabel.agent:embabel-agent-a2a (>=0.5.0, <=1.0.0) +255 more potentially affected by CVE-2026-35568 via io.modelcontextprotocol.sdk:mcp-core (0.18.2)

io.modelcontextprotocol.sdk:mcp-core MAVEN version 0.18.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.modelcontextprotocol.sdk:mcp-core and may be impacted: - cn.net.pap.example:pap4j-boot3-example-spring-ai 0.0.4 -...

cn.echoparrot:echoparrot-application (25.4.0), com.alibaba.cloud.ai:spring-ai-alibaba-autoconfigure-mcp-distributed (>=1.1.0.0-rc1, <=1.1.0.0) +86 more potentially affected by CVE-2026-35568 via io.modelcontextprotocol.sdk:mcp-core (0.16.0)

io.modelcontextprotocol.sdk:mcp-core MAVEN version 0.16.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.modelcontextprotocol.sdk:mcp-core and may be impacted: - cn.echoparrot:echoparrot-application 25.4.0 -...

ai.agentican:agentican-framework-core (>=0.1.0-alpha.1, <=0.1.0-alpha.4), ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +152 more potentially affected by CVE-2026-34237 via io.modelcontextprotocol.sdk:mcp-core (1.1.0)

io.modelcontextprotocol.sdk:mcp-core MAVEN version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.modelcontextprotocol.sdk:mcp-core and may be impacted: - ai.agentican:agentican-framework-core =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1,...

ai.agentican:agentican-framework-core (>=0.1.0-alpha.1, <=0.1.0-alpha.4), ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +152 more potentially affected by CVE-2026-34237 via io.modelcontextprotocol.sdk:mcp-core (1.1.0)

io.modelcontextprotocol.sdk:mcp-core MAVEN version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.modelcontextprotocol.sdk:mcp-core and may be impacted: - ai.agentican:agentican-framework-core =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1,...

Permissive Cross-domain Policy with Untrusted Domains

Overview Affected versions of this package are vulnerable to Permissive Cross-domain Policy with Untrusted Domains via the HttpServletSseServerTransportProvider and HttpServletStreamableServerTransportProvider classes. An attacker can access sensitive session information by leveraging a malicious...

ai.agentican:agentican-framework-core (>=0.1.0-alpha.1, <=0.1.0-alpha.4), ai.agentican:agentican-quarkus-deployment (>=0.1.0-alpha.1, <=0.1.0-alpha.4) +152 more potentially affected by CVE-2026-34237 via io.modelcontextprotocol.sdk:mcp-core (1.1.0)

io.modelcontextprotocol.sdk:mcp-core MAVEN version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.modelcontextprotocol.sdk:mcp-core and may be impacted: - ai.agentican:agentican-framework-core =0.1.0-alpha.1, =0.1.0-alpha.1, =0.1.0-alpha.1,...