Threat database

2 threats

Threat database
Severity	CVSS	Signals	Threat	Source	Published	Score and star
High	8.7	EPSS 0.5%	CVE-2026-108859mcp-go · Allocation of Resources Without Limits or Throttling High8.7EPSS 0.5%2026-10-11CVE Database V5CVE-2026-108859 mcp-go versions up to 1.2.1 have a denial of service vulnerability in the StreamableHTTPServer.ServeHTTP function. Remote unauthenticated attackers can send oversized POST requests that are fully read into memory before validation, allowing them to exhaust server memory and potentially cause the server to crash or become unresponsive. EPSS 0.5%Vulnerability mark3labs #ghsa-c673-ppxx-9wvj	CVE Database V5	2026-10-11
High	7.6	EPSS 0.2%	CVE-2026-81092mcp-go · Origin Validation Error High7.6EPSS 0.2%2026-08-27CVE Database V5CVE-2026-81092 CVE-2026-81092 is a high-severity vulnerability in mark3labs mcp-go prior to version 0.56.0. The software accepted HTTP requests on its loopback interface without validating the Host header, allowing cross-origin requests from browser pages to access local services. This flaw could enable a malicious web page to interact with local servers that assume only local software can connect. Version 0.56.0 introduced validation to reject loopback requests with non-loopback Host headers, mitigating this issue. EPSS 0.2%Vulnerability mark3labs	CVE Database V5	2026-08-27

Showing 1–2 of 2 results