GHSA-4432-vg92-fqh6
Unbounded tool schema cache in Streamable HTTP server transport
GHSA-4432-vg92-fqh6 is a high vulnerability (CVSS 7.5) in rmcp, published October 20, 2026. No source lists public exploit code. Fixed in rmcp 3.6.0.
- Severity
- 7.5 HighCVSS 3.1, OSV
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
3.6.0rmcp
Description
From 3.0.0 until 3.6.0, StreamableHttpService cached the result of
ServerHandler::get_tool in a process-wide map keyed by the tool name of
incoming tools/call requests. The map had no size limit and no eviction, and
it also cached unknown tool names.
An entry was added while the request headers were validated, before the request
could be rejected, so requests answered with HTTP 400 still grew the map. A
client that can reach the endpoint can send tools/call requests with distinct
tool names, each up to the default 4 MiB body limit, until the server runs out
of memory. rmcp does not authenticate requests itself, so servers without an
authentication layer in front of the endpoint are exposed to unauthenticated
clients.
Only servers that use the Streamable HTTP server transport and receive requests
at protocol version 2026-07-28 or later are affected.
The flaw was corrected in 3.6.0 by removing the cache. The transport now calls
ServerHandler::get_tool on each request.
If you cannot upgrade, put authentication in front of the endpoint, or reject
tools/call requests for unknown tool names before they reach
StreamableHttpService.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Affected packages
| Package | Affected | Fixed |
|---|---|---|
rmcpcrates.io | 3.0.0 up to 3.6.0 | 3.6.0 |
What each source reports
OSV Score usedRUSTSEC-2026-0461
Unbounded tool schema cache in Streamable HTTP server transport
From 3.0.0 until 3.6.0, StreamableHttpService cached the result of
ServerHandler::get_tool in a process-wide map keyed by the tool name of
incoming tools/call requests. The map had no size limit and no eviction, and
it also cached unknown tool names.
An entry was added while the request headers were validated, before the request
could be rejected, so requests answered with HTTP 400 still grew the map. A
client that can reach the endpoint can send tools/call requests with distinct
tool names, each up to the default 4 MiB body limit, until the server runs out
of memory. rmcp does not authenticate requests itself, so servers without an
authentication layer in front of the endpoint are exposed to unauthenticated
clients.
Only servers that use the Streamable HTTP server transport and receive requests
at protocol version 2026-07-28 or later are affected.
The flaw was corrected in 3.6.0 by removing the cache. The transport now calls
ServerHandler::get_tool on each request.
If you cannot upgrade, put authentication in front of the endpoint, or reject
tools/call requests for unknown tool names before they reach
StreamableHttpService.
- Record
RUSTSEC-2026-0461- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-09
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.