AIKIDO-2026-190480

TL;DR

The MCP server request handling in mcp/sdk does not bound untrusted input on the Streamable HTTP transport and JSON-RPC parser. StreamableHttpTransport reads the entire POST body into memory with no size cap, MessageFactory accepts JSON-RPC batches of unbounded size and mishandles scalar or empty payloads, and a malformed or duplicated Mcp-Session-Id header reaches Uuid::fromString() and raises an uncaught exception. A remote client can exhaust server memory with an oversized body or huge batch, or crash request handling with a malformed session header. The fix enforces a maxBodyBytes cap with incremental reads, adds a maxBatchSize limit, rejects scalar/empty/non-object JSON-RPC input, and returns 400 for malformed or repeated session ID headers.