Tools AI Risk Radar ai-incident-0241
Incident record
MCP tool validation could exhaust server memory
- Severity
- High
- Status
- Patched
- Type
- Infra Vuln
- Target
- modelcontextprotocol/typescript-sdk
- Actor
- researcher
- CVE
- CVE-2026-111768
What happened
A request within the normal body-size limit could exhaust memory while the server validated a very large collection of tool inputs.
The fix adds maxToolInputElements in SDK 1.32.0 and server 2.3.0, but the option is off by default. Operators must enable it and set suitable request-body limits. HTTP reachability and authentication determine who can send the request.
Sources
- Maintainer security advisorygithub.com/modelcontextprotocol/typescript-sdk/security/advi…
One record from the AI Risk Radar, maintained by the Security Desk.Data: CSV · JSON ·RSS · CC BY 4.0 with attribution to YFarmX.Tracker updated · 28 October 2026