Skip to content

Add advisory for rmcp unbounded HTTP response bodies #3504

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
DaleSeo wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Add advisory for rmcp unbounded HTTP response bodies #3504

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
45 changes: 45 additions & 0 deletions crates/rmcp/RUSTSEC-0000-0000.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,45 @@
```toml
[advisory]
id = "RUSTSEC-0000-0000"
package = "rmcp"
date = "2026-11-05"
url = "https://github.com/modelcontextprotocol/rust-sdk/security/advisories/GHSA-c9f9-cp8h-jcj5"
references = ["https://github.com/modelcontextprotocol/rust-sdk/commit/3e0156c1eaf1573a1b878e2a8998d2fa2d0b1439"]
categories = ["denial-of-service"]
cvss = "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"
keywords = ["mcp", "http", "memory-exhaustion"]
aliases = ["GHSA-c9f9-cp8h-jcj5"]

[versions]
patched = [">= 3.9.0"]
unaffected = ["< 0.2.0"]
```

# Unbounded response body buffering in Streamable HTTP clients

Before 3.9.0, the built-in Streamable HTTP clients in rmcp read non-streaming
HTTP response bodies into memory with no size limit. Both the reqwest client
(`transport-streamable-http-client-reqwest`) and the Unix socket client
(`transport-streamable-http-client-unix-socket`) were affected:

- `application/json` responses to POST requests were read in full before
parsing.
- Non-2xx responses were read in full for error reporting.

A malicious or compromised MCP server can answer with a body that never ends,
for example a chunked `application/json` response that streams whitespace. The
client buffers it until the process runs out of memory. This works during
`initialize`, before any authentication. On desktop or agent hosts, this
terminates the whole host application.

Server-sent event streams are not affected. Each event is already capped by
`max_sse_event_size`, and events are not accumulated.

The flaw was corrected in 3.9.0. Successful JSON bodies are limited to 16 MiB
and non-success bodies to 64 KiB. Bytes are counted while streaming, after
decompression. An oversized `Content-Length` is rejected before the body is
read, and an oversized body is rejected with
`StreamableHttpError::ResponseBodyTooLarge` instead of being truncated.

If you cannot upgrade, use a custom `StreamableHttpClient` that enforces a
response body limit, or connect only to trusted MCP servers.
Loading