CVE-2026-14539 Denial of Service via Unrestricted Payload Buffering in MCP Toolbox

An allocation of resources without limits vulnerability in the HTTP handler component of Google mcp-toolbox versions up to and including 1.4.0 allows an unauthenticated attacker to cause a denial of service DoS. The /mcp endpoint handler reads incoming payloads directly into system memory using a...

CVE-2026-14539

The CVE affects Google mcp-toolbox versions up to 1.4.0, where the HTTP /mcp endpoint reads request bodies into memory using an unrestricted buffer (io.ReadAll) without limits. This unbounded buffering enables an unauthenticated attacker to cause a DoS by exhausting host memory, ultimately leadin...

GHSA-H27X-G6W4-24GQ Next.js: Unbounded postponed resume buffering can lead to DoS

Summary A request containing the next-resume: 1 header corresponding with a PPR resume request would buffer request bodies without consistently enforcing maxPostponedStateSize in certain setups. The previous mitigation protected minimal-mode deployments, but equivalent non-minimal deployments...