The vulnerability resides in the Model Context Protocol Python SDK, where the Streamable HTTP session manager, SSE message endpoint, and OAuth authorization-server routes buffer complete HTTP request bodies without imposing a maximum size. An unauthenticated remote client can send an arbitrarily large declared or streamed body, forcing the SDK to allocate memory proportional to the received content. The resulting memory exhaustion can cause the server to crash or become unresponsive, a flaw classified as CWE-770.

Products affected are the Model Context Protocol Python SDK distributed by the modelcontextprotocol. Versions prior to 1.29.1 and 2.0.0a1 through 2.0.1 contain the unbounded buffer logic. The standard SDK server applications and session managers that ship with the SDK are impacted. Applications that instantiate StreamableHTTPServerTransport directly remain responsible for setting their own request size limits. The vulnerability was fixed in SDK release 1.29.1 and 2.1.0.

The CVSS score for this issue is 7.5, indicating high severity. EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread active exploitation yet. Nevertheless, an attacker can trigger the issue by sending a large request to an exposed HTTP or OAuth endpoint from any network location, without authentication. The consequence is predictable memory exhaustion that will either crash the server or degrade performance until reclamation occurs, making the risk significant for exposed deployments.