{"id":"GHSA-c9f9-cp8h-jcj5","aliases":["RUSTSEC-2026-0462"],"status":"published","title":"Unbounded response body buffering in Streamable HTTP clients","description":"Before 3.9.0, the built-in Streamable HTTP clients in rmcp read non-streaming\nHTTP response bodies into memory with no size limit. Both the reqwest client\n(`transport-streamable-http-client-reqwest`) and the Unix socket client\n(`transport-streamable-http-client-unix-socket`) were affected:\n\n- `application/json` responses to POST requests were read in full before\n  parsing.\n- Non-2xx responses were read in full for error reporting.\n\nA malicious or compromised MCP server can answer with a body that never ends,\nfor example a chunked `application/json` response that streams whitespace. The\nclient buffers it until the process runs out of memory. This works during\n`initialize`, before any authentication. On desktop or agent hosts, this\nterminates the whole host application.\n\nServer-sent event streams are not affected. Each event is already capped by\n`max_sse_event_size`, and events are not accumulated.\n\nThe flaw was corrected in 3.9.0. Successful JSON bodies are limited to 16 MiB\nand non-success bodies to 64 KiB. Bytes are counted while streaming, after\ndecompression. An oversized `Content-Length` is rejected before the body is\nread, and an oversized body is rejected with\n`StreamableHttpError::ResponseBodyTooLarge` instead of being truncated.\n\nIf you cannot upgrade, use a custom `StreamableHttpClient` that enforces a\nresponse body limit, or connect only to trusted MCP servers.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium","from":"osv"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-11-05T12:00:00Z","modified":"2026-11-09T10:30:02Z","fixes":[{"ecosystem":"crates.io","package":"rmcp","fixed_in":["3.9.0"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"crates.io","package":"rmcp","ranges":[{"type":"SEMVER","events":[{"introduced":"0.2.0"},{"fixed":"3.9.0"}]}]}],"references":[{"url":"https://crates.io/crates/rmcp","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0462.html","tags":["advisory"]},{"url":"https://github.com/modelcontextprotocol/rust-sdk/commit/3e0156c1eaf1573a1b878e2a8998d2fa2d0b1439","tags":["web"]}],"sources":{"osv":[{"id":"RUSTSEC-2026-0462","title":"Unbounded response body buffering in Streamable HTTP clients","description":"Before 3.9.0, the built-in Streamable HTTP clients in rmcp read non-streaming\nHTTP response bodies into memory with no size limit. Both the reqwest client\n(`transport-streamable-http-client-reqwest`) and the Unix socket client\n(`transport-streamable-http-client-unix-socket`) were affected:\n\n- `application/json` responses to POST requests were read in full before\n  parsing.\n- Non-2xx responses were read in full for error reporting.\n\nA malicious or compromised MCP server can answer with a body that never ends,\nfor example a chunked `application/json` response that streams whitespace. The\nclient buffers it until the process runs out of memory. This works during\n`initialize`, before any authentication. On desktop or agent hosts, this\nterminates the whole host application.\n\nServer-sent event streams are not affected. Each event is already capped by\n`max_sse_event_size`, and events are not accumulated.\n\nThe flaw was corrected in 3.9.0. Successful JSON bodies are limited to 16 MiB\nand non-success bodies to 64 KiB. Bytes are counted while streaming, after\ndecompression. An oversized `Content-Length` is rejected before the body is\nread, and an oversized body is rejected with\n`StreamableHttpError::ResponseBodyTooLarge` instead of being truncated.\n\nIf you cannot upgrade, use a custom `StreamableHttpClient` that enforces a\nresponse body limit, or connect only to trusted MCP servers.","status":"published","published":"2026-11-05T12:00:00Z","modified":"2026-11-09T10:30:02.590803911Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-09T10:53:57.550641Z"}]}}