From 42f3317b07fbff3cdfee0ea1b09623ecb96ea0f8 Mon Sep 17 00:00:00 2001
From: Dale Seo <5466341+DaleSeo@users.noreply.github.com>
Date: Thu, 5 Nov 2026 11:56:09 -0500
Subject: [PATCH] Add advisory for rmcp unbounded HTTP response bodies

---
 crates/rmcp/RUSTSEC-0000-0000.md | 45 ++++++++++++++++++++++++++++++++
 1 file changed, 45 insertions(+)
 create mode 100644 crates/rmcp/RUSTSEC-0000-0000.md

diff --git a/crates/rmcp/RUSTSEC-0000-0000.md b/crates/rmcp/RUSTSEC-0000-0000.md
new file mode 100644
index 0000000000..b4dc61060d
--- /dev/null
+++ b/crates/rmcp/RUSTSEC-0000-0000.md
@@ -0,0 +1,45 @@
+```toml
+[advisory]
+id = "RUSTSEC-0000-0000"
+package = "rmcp"
+date = "2026-11-05"
+url = "https://github.com/modelcontextprotocol/rust-sdk/security/advisories/GHSA-c9f9-cp8h-jcj5"
+references = ["https://github.com/modelcontextprotocol/rust-sdk/commit/3e0156c1eaf1573a1b878e2a8998d2fa2d0b1439"]
+categories = ["denial-of-service"]
+cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
+keywords = ["mcp", "http", "memory-exhaustion"]
+aliases = ["GHSA-c9f9-cp8h-jcj5"]
+
+[versions]
+patched = [">= 3.9.0"]
+unaffected = ["< 0.2.0"]
+```
+
+# Unbounded response body buffering in Streamable HTTP clients
+
+Before 3.9.0, the built-in Streamable HTTP clients in rmcp read non-streaming
+HTTP response bodies into memory with no size limit. Both the reqwest client
+(`transport-streamable-http-client-reqwest`) and the Unix socket client
+(`transport-streamable-http-client-unix-socket`) were affected:
+
+- `application/json` responses to POST requests were read in full before
+  parsing.
+- Non-2xx responses were read in full for error reporting.
+
+A malicious or compromised MCP server can answer with a body that never ends,
+for example a chunked `application/json` response that streams whitespace. The
+client buffers it until the process runs out of memory. This works during
+`initialize`, before any authentication. On desktop or agent hosts, this
+terminates the whole host application.
+
+Server-sent event streams are not affected. Each event is already capped by
+`max_sse_event_size`, and events are not accumulated.
+
+The flaw was corrected in 3.9.0. Successful JSON bodies are limited to 16 MiB
+and non-success bodies to 64 KiB. Bytes are counted while streaming, after
+decompression. An oversized `Content-Length` is rejected before the body is
+read, and an oversized body is rejected with
+`StreamableHttpError::ResponseBodyTooLarge` instead of being truncated.
+
+If you cannot upgrade, use a custom `StreamableHttpClient` that enforces a
+response body limit, or connect only to trusted MCP servers.