CVE-2026-14539
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk11th percentile - higher than 11% of all known CVEs
Summary
Google mcp-toolbox versions up to 1.4.0 have an allocation of resources without limits vulnerability in the HTTP handler component. The /mcp endpoint reads incoming payloads directly into system memory using an unrestricted buffer loop (io.ReadAll) without defensive constraints. An unauthenticated attacker can submit a single massive HTTP request, linearly consuming host memory until the process is terminated by an OOM error.
Risk Assessment
An attacker can cause a denial of service by crashing the mcp-toolbox service, disrupting all users without requiring authentication.
Recommendation
Upgrade Google mcp-toolbox to a version later than 1.4.0, which includes a fix to limit HTTP request sizes.
Other vulnerabilities in Google mcp-toolbox
See all- CVE-2026-14537Critical
In Google mcp-toolbox versions v1.3.0 and v1.4.0, incorrect authorization in the direct HTTP API tool invocation endpoint allows an unauthenticated attacker to invoke tools protected by scopeRequired via legacy HTTP endpoints when the --enable-api flag is active.
- CVE-2026-14541High
In Google mcp-toolbox version 1.4.0, when Google OAuth is configured with mcpEnabled: true without explicit audience or clientId, opaque token audience validation is skipped, allowing acceptance of any valid Google OAuth token from other applications.
- CVE-2026-14540Medium
In Google mcp-toolbox versions 0.3.0 through 1.4.0, an SSRF vulnerability exists in HTTP source and tool components due to missing restrictive CheckRedirect policy and target IP validation, allowing requests to be redirected to internal or arbitrary external endpoints.
- CVE-2026-14538High
Google mcp-toolbox versions 0.16.1 through 1.4.0 have an improper authorization and security-boundary bypass vulnerability in the bigquery-execute-sql tool component. The toolbox relies on the BigQuery dry-run API to enforce dataset restrictions, but due to a fail-open logic flaw, it bypasses validation when the API returns an empty array for specialized constructs. An authenticated attacker can extract structural DDL schemas for excluded datasets via INFORMATION_SCHEMA and access downstream federated row data via EXTERNAL_QUERY connections.
Original NVD description (English source)
An allocation of resources without limits vulnerability in the HTTP handler component of Google mcp-toolbox versions up to and including 1.4.0 allows an unauthenticated attacker to cause a denial of service (DoS). The /mcp endpoint handler reads incoming payloads directly into system memory using an unrestricted buffer loop (io.ReadAll) without applying defensive constraints such as http.MaxBytesReader or pre-read Content-Length enforcement. By submitting a single, massive HTTP request body, an attacker can linearly consume available host memory until the runtime process is terminated by an Out-Of-Memory (OOM) error.