AIKIDO-2026-404389
mcp is vulnerable to Denial of Service (DoS)
75
High Risk
This Affects:
mcpTL;DR
A Streamable HTTP server in the default stateful mode never frees session state. Sessions do not expire, a client DELETE leaves the session entry registered, and a session whose first request is refused stays registered with a running task. Each session keeps its parsed initialize payload and there is no cap on the number of sessions, so a client that can reach the endpoint can grow server memory without bound with ordinary short requests, and only a restart frees it. The fix adds an idle session timeout, caps the number of concurrent sessions, and discards a session as soon as it ends.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you serve MCP over Streamable HTTP in the default stateful mode with clients you do not fully trust.
Background info
mcp is vulnerable to Denial of Service (DoS) in versions 1.8.0 - 1.29.1 and 2.0.0 - 2.1.1.
How to fix this
Upgrade the mcp library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.