The vulnerability in Google MCP Toolbox occurs in the HTTP handler component that reads incoming payloads directly into system memory by looping with io.ReadAll. The handler lacks any defensive limits such as http.MaxBytesReader or Content-Length checks. Because of this resource allocation without bounds, an unauthenticated attacker can submit an oversized HTTP request body to the /mcp endpoint, causing the process to consume all available host memory. Eventually, the runtime terminates the process with an Out‑Of‑Memory error, leading to a denial of service. The weakness aligns with CWE‑770: Allocation of Resources Without Limits.

Affected systems are instances of Google’s MCP Toolbox service, specifically all versions up to and including 1.4.0. The flaw resides in the /mcp HTTP endpoint handler and requires no authentication. Any external user who can send HTTP requests to the service may trigger the DoS.

The publicly published CVSS score of 6.6 indicates a moderate severity with limited impact scope. The EPSS score of < 1% (0.00215) suggests a low probability of exploitation. The lack of authentication and absence of request‑size limits mean an attacker must only have network reachability to send an oversized payload to the /mcp endpoint, which would consume host memory until the process encounters an OOM error. The vulnerability is not listed in the CISA KEV catalog.