CVE-2026-39313

mcp-framework is a framework for building Model Context Protocol MCP servers. In versions 0.2.21 and below, the readRequestBody function in the HTTP transport concatenates request body chunks into a string with no size limit. Although a maxMessageSize configuration value exists, it is never...

CVE-2026-39313 MCP-Framework: Unbounded memory allocation in readRequestBody allows denial of service via HTTP transport

mcp-framework is a framework for building Model Context Protocol MCP servers. In versions 0.2.21 and below, the readRequestBody function in the HTTP transport concatenates request body chunks into a string with no size limit. Although a maxMessageSize configuration value exists, it is never...

CVE-2026-39313 MCP-Framework: Unbounded memory allocation in readRequestBody allows denial of service via HTTP transport

mcp-framework is a framework for building Model Context Protocol MCP servers. In versions 0.2.21 and below, the readRequestBody function in the HTTP transport concatenates request body chunks into a string with no size limit. Although a maxMessageSize configuration value exists, it is never...

CVE-2026-39313

mcp-framework is a framework for building Model Context Protocol MCP servers. In versions 0.2.21 and below, the readRequestBody function in the HTTP transport concatenates request body chunks into a string with no size limit. Although a maxMessageSize configuration value exists, it is never...

CVE-2026-39313

CVE-2026-39313 affects mcp-framework's HTTP transport (readRequestBody) where concatenation of request chunks has no size limit. Versions 0.2.21 and earlier are vulnerable; an unauthenticated remote attacker can crash an HTTP server by sending a single large POST to /mcp, causing memory exhaustio...

CVE-2026-33082

creationtimestamp| type| source ---|---|--- 2026-04-16 21:19:31+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjndkfx7322k 2026-04-17 05:18:08+00:00| published-proof-of-concept| Telegram/MfRD7ll8pGcGi3RGemlsgII30sQ-Y2l5bpdSqMK2BdYlKE 2026-04-20 19:10:54+00:00| seen|...

CVE-2025-68109

creationtimestamp| type| source ---|---|--- 2026-04-16 21:02:32+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3mjncncgazj2p 2026-09-08 06:49:43+00:00| seen| https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/churchcrmdbrestorerce.rb...

GHSA-353C-V8X9-V7C3 MCP-Framework: Unbounded memory allocation in readRequestBody allows denial of service via HTTP transport

Summary The readRequestBody function in src/transports/http/server.ts concatenates HTTP request body chunks into a string with no size limit, allowing a remote unauthenticated attacker to crash the server via memory exhaustion with a single large HTTP POST request. Details File:...

MCP-Framework: Unbounded memory allocation in readRequestBody allows denial of service via HTTP transport

Summary The readRequestBody function in src/transports/http/server.ts concatenates HTTP request body chunks into a string with no size limit, allowing a remote unauthenticated attacker to crash the server via memory exhaustion with a single large HTTP POST request. Details File:...

Allocation of Resources Without Limits or Throttling

Overview mcp-framework is a Framework for building Model Context Protocol MCP servers in Typescript Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the readRequestBody function. An attacker can exhaust system memory and cause a server...

CVE-2026-37338

creationtimestamp| type| source ---|---|--- 2026-04-16 20:44:29+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjnbkprs2p2f...

CVE-2026-34018

creationtimestamp| type| source ---|---|--- 2026-04-16 20:00:00+00:00| seen| https://jvn.jp/en/jp/JVN78422311 2026-04-17 06:05:15+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjoaxsb5ce2s 2026-04-20 17:20:51+00:00| seen| Telegram/GfeUhnyJYShCjvs7rm1XQAQJnKqowYjnl2h2DVxLAV4-eNA...

CVE-2026-34161

Chamilo LMS is an open-source learning management system. In versions prior to 2.0.0-RC.3, a Stored Cross-Site Scripting XSS vulnerability exists in the social post attachment upload functionality, where an authenticated user can upload a malicious HTML file containing JavaScript via the...

CVE-2025-36579

creationtimestamp| type| source ---|---|--- 2026-04-16 18:14:02+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjmz6xedk72d...

CVE-2026-6409

creationtimestamp| type| source ---|---|--- 2026-04-16 17:21:05+00:00| published-proof-of-concept| Telegram/YKX-6KXVqHKUWR-VRt4uZwi-aDyDZ2w2e-w4Y4gyD3o3fyw 2026-04-16 18:23:49+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjmzqy3ntc26...

CVE-2026-3324

creationtimestamp| type| source ---|---|--- 2026-04-16 17:08:02+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjmvjyv6jw2q 2026-04-16 17:20:51+00:00| seen| Telegram/s117pb2GT3VwdfXaV13Oi8Gqr-ePRyI5oBJZVU7ek3MbpQ...

CVE-2026-31987

creationtimestamp| type| source ---|---|--- 2026-04-16 17:07:20+00:00| seen| https://bsky.app/profile/infosec.skyfleet.blue/post/3mjmvirpmir2y 2026-04-18 05:18:34+00:00| published-proof-of-concept| Telegram/veDSMFN7ecyhltWdKUwpcYAyE-ogEw-qfchv6YBZH7Zn1oc...

CVE-2025-49931

creationtimestamp| type| source ---|---|--- 2026-04-16 17:07:09+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mjmvieto772e...

CVE-2026-37347

creationtimestamp| type| source ---|---|--- 2026-04-16 16:58:01+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mjmuy42mew2f 2026-04-17 08:15:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116419049012865228...

Building your cryptographic inventory: A customer strategy for cryptographic posture management

Post-quantum cryptography PQC is coming—and for most organizations, the hardest part won’t be choosing new algorithms. It will be finding where cryptography is used today across applications, infrastructure, devices, and services so teams can plan, prioritize, and modernize with confidence. At...