{"id":"RUSTSEC-2026-0462","summary":"Unbounded response body buffering in Streamable HTTP clients","details":"Before 3.9.0, the built-in Streamable HTTP clients in rmcp read non-streaming\nHTTP response bodies into memory with no size limit. Both the reqwest client\n(`transport-streamable-http-client-reqwest`) and the Unix socket client\n(`transport-streamable-http-client-unix-socket`) were affected:\n\n- `application/json` responses to POST requests were read in full before\n  parsing.\n- Non-2xx responses were read in full for error reporting.\n\nA malicious or compromised MCP server can answer with a body that never ends,\nfor example a chunked `application/json` response that streams whitespace. The\nclient buffers it until the process runs out of memory. This works during\n`initialize`, before any authentication. On desktop or agent hosts, this\nterminates the whole host application.\n\nServer-sent event streams are not affected. Each event is already capped by\n`max_sse_event_size`, and events are not accumulated.\n\nThe flaw was corrected in 3.9.0. Successful JSON bodies are limited to 16 MiB\nand non-success bodies to 64 KiB. Bytes are counted while streaming, after\ndecompression. An oversized `Content-Length` is rejected before the body is\nread, and an oversized body is rejected with\n`StreamableHttpError::ResponseBodyTooLarge` instead of being truncated.\n\nIf you cannot upgrade, use a custom `StreamableHttpClient` that enforces a\nresponse body limit, or connect only to trusted MCP servers.","aliases":["GHSA-c9f9-cp8h-jcj5"],"modified":"2026-11-09T10:30:02.590803911Z","published":"2026-11-05T12:00:00Z","database_specific":{"license":"CC0-1.0"},"references":[{"type":"PACKAGE","url":"https://crates.io/crates/rmcp"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0462.html"},{"type":"WEB","url":"https://github.com/modelcontextprotocol/rust-sdk/commit/3e0156c1eaf1573a1b878e2a8998d2fa2d0b1439"}],"affected":[{"package":{"name":"rmcp","ecosystem":"crates.io","purl":"pkg:cargo/rmcp"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0.2.0"},{"fixed":"3.9.0"}]}],"ecosystem_specific":{"affects":{"arch":[],"os":[],"functions":[]},"affected_functions":null},"database_specific":{"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0462.json","informational":null,"categories":["denial-of-service"],"cvss":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H"}]}