CVE-2026-14539: Google mcp-toolbox DoS Vulnerability

CVE-2026-14539 Overview

CVE-2026-14539 is a denial-of-service vulnerability in the HTTP handler of Google mcp-toolbox through version 1.4.0. The /mcp endpoint reads incoming request bodies into memory using an unrestricted io.ReadAll loop. The handler does not apply http.MaxBytesReader or enforce a Content-Length limit before reading. An unauthenticated remote attacker can submit a single oversized HTTP request body to exhaust host memory. The runtime process then terminates with an Out-Of-Memory (OOM) condition. The issue is tracked as CWE-770: Allocation of Resources Without Limits or Throttling.

Critical Impact
An unauthenticated network attacker can force an OOM crash of the mcp-toolbox process with a single large HTTP request, disrupting availability of any service exposing the /mcp endpoint.

Affected Products

Google mcp-toolbox versions up to and including 1.4.0
Deployments exposing the /mcp HTTP endpoint to untrusted networks
Downstream services embedding vulnerable mcp-toolbox releases

Discovery Timeline

2026-07-31 - CVE-2026-14539 published to NVD
2026-08-06 - Last updated in NVD database

Technical Details for CVE-2026-14539

Vulnerability Analysis

The vulnerability resides in the HTTP handler serving the /mcp endpoint of Google mcp-toolbox. The handler invokes io.ReadAll on the incoming http.Request.Body without wrapping it in http.MaxBytesReader or validating the advertised Content-Length. Because io.ReadAll grows its internal buffer to accommodate all bytes returned by the reader, the memory footprint scales linearly with the size of the attacker-supplied body. A single large POST request forces the Go runtime to allocate proportionally large slices on the heap. When available memory is exhausted, the operating system OOM killer terminates the process. Recovery requires manual or supervisor-driven restart, during which the service remains unavailable to legitimate clients.

Root Cause

The root cause is missing input size enforcement in the request lifecycle. The handler trusts the client to provide a reasonably sized payload and never bounds the read. Neither a byte ceiling on the reader nor a pre-read check against Content-Length is applied. This pattern maps directly to CWE-770, where a resource — in this case heap memory — is allocated without a governing limit.

Attack Vector

Exploitation requires only network reachability to the vulnerable /mcp endpoint. No authentication, credentials, or user interaction are needed. An attacker crafts an HTTP request whose body is sized to exceed the target host's available memory, then submits it to the endpoint. The Go server reads bytes into memory until the process is killed. Repeated requests, even from a single source, keep the service continuously offline. Refer to the upstream fix in the Google mcp-toolbox GitHub Pull Request #3216 for the exact code path and patched behavior.

Detection Methods for CVE-2026-14539

Indicators of Compromise

HTTP POST requests to /mcp with abnormally large Content-Length values or chunked bodies exceeding expected payload sizes.
Unexpected process terminations of mcp-toolbox accompanied by kernel oom-killer entries in dmesg or /var/log/messages.
Sudden spikes in resident set size (RSS) of the mcp-toolbox process shortly before a crash.
Repeated requests from a single source IP correlating with service restarts or health-check failures.

Detection Strategies

Instrument the reverse proxy or ingress in front of mcp-toolbox to log request body sizes and flag entries above a defined threshold.
Alert on process restarts of mcp-toolbox and correlate with concurrent HTTP request volume to the /mcp path.
Baseline normal payload sizes for the /mcp endpoint and alert on statistical outliers.

Monitoring Recommendations

Forward web server, reverse proxy, and host syslog streams into a centralized analytics platform for correlation of OOM events with request patterns.
Track memory utilization of the mcp-toolbox process with node-level metrics and alert on rapid growth.
Monitor upstream 5xx error rates and connection resets, which often accompany OOM-driven crashes.

How to Mitigate CVE-2026-14539

Immediate Actions Required

Upgrade mcp-toolbox to a release later than 1.4.0 that includes the fix from Pull Request #3216.
Restrict network exposure of the /mcp endpoint to trusted clients using firewall rules, service mesh policy, or authenticated ingress.
Enforce a request body size limit at the reverse proxy or API gateway in front of mcp-toolbox.

Patch Information

The upstream fix is available in the Google mcp-toolbox repository via Pull Request #3216. The patch bounds the HTTP body read so oversized payloads are rejected before consuming host memory. Operators should upgrade to a release that incorporates this pull request and validate that the /mcp handler no longer reads unbounded input.

Workarounds

Place mcp-toolbox behind a reverse proxy such as NGINX or Envoy and configure a client_max_body_size or equivalent limit sized to expected traffic.
Apply per-source rate limiting to the /mcp endpoint to reduce the impact of repeated large-body submissions.
Run mcp-toolbox under a process supervisor with memory cgroup limits so an OOM event is confined and the service is automatically restarted.

bash

# NGINX example: cap request bodies to /mcp at 1 MB
location /mcp {
    client_max_body_size 1m;
    proxy_pass http://mcp_toolbox_upstream;
}