The affected transports read incoming HTTP request bodies entirely into heap memory without imposing a size limit. An attacker can send a POST request with an arbitrarily large body, even using chunked transfer encoding, until the Java process exhausts its heap and becomes unavailable. This remote unbounded read leads directly to a denial‑of‑service scenario for the affected server instance. The flaw exists in unauthenticated contexts, but authentication, origin or host validation, or an upstream request‑size cap can block the request before it reaches the vulnerable read. The issue is fixed in newer releases (0.18.4, 1.1.4, and 2.0.1).

The vulnerability impacts the Model Context Protocol Java SDK, specifically the io.modelcontextprotocol.sdk:mcp and io.modelcontextprotocol.sdk:mcp-core artifacts. Affected versions include 0.8.0 through 0.12.0 for mcp, 0.13.0 through 0.18.3 and 1.0.0 through 1.1.3 for mcp-core, and mcp-core 2.0.0‑M1 through 2.0.0. All other releases beyond these versions are not affected. The remediation applies to the mentioned product lines and versions.

The CVSS score of 7.5 reflects a significant impact, and the lack of an EPSS value indicates no current exploitation data is available, although the attack scenario requires only an unauthenticated HTTP connection to a reachable transport. The flaw is not listed in the CISA KEV catalog, implying no publicly known exploits have been actively leveraged. An attacker could exploit the weakness by sending large payloads over HTTP to the server transports, potentially causing denial of service. Mitigating factors include authentication checks, origin or host validation, or upstream request‑size limits that can reject requests before the vulnerable read occurs.