{"id":"EM-20261105-X3T2","url":"https://cyber.eventmonitor.net/incident/EM-20261105-X3T2/modelcontextprotocol-sdk-vulnerability-cve-2026-111768/","type":"cve","title":"@modelcontextprotocol/sdk Vulnerability (CVE-2026-111768)","subtitle":"CVE-2026-111768","subject":"CVE-2026-111768","status":"Developing","severity":"high","affected":[],"headline":null,"born":"2026-11-05T22:17:45.457Z","firstSignal":"2026-11-05T21:22:44.000Z","lastSignal":"2026-11-05T22:17:45.457Z","updated":"2026-11-06T12:16:45.734Z","revision":1,"life":[{"status":"Born","at":"2026-11-05T22:17:45.457Z","why":"second independent source: C6 NVD CVE API 2.0"},{"status":"Developing","at":"2026-11-05T22:17:45.457Z","why":"signals keep joining"}],"changeLog":[{"at":"2026-11-05T21:22:44.000Z","what":"First signal: C41 Red Hat Security Data"},{"at":"2026-11-05T22:17:45.457Z","what":"Born: second source, C6 NVD CVE API 2.0. Page EM-20261105-X3T2 created."}],"stages":[{"name":"Disclosed","at":"2026-11-05T22:17:45.457Z","detail":"C6 NVD published"},{"name":"Scored","at":"2026-11-05T22:17:45.457Z","detail":"CVSS 7.5"},{"name":"Exploited","at":null,"detail":"No exploitation reported"},{"name":"Advisories","at":null,"detail":"None yet"},{"name":"Vendor Response","at":"2026-11-05T21:22:44.000Z","detail":"C41 published"},{"name":"Resolved","at":null,"detail":"After 14 quiet days"}],"signals":[{"at":"2026-11-05T21:22:44.000Z","source":"C41","sourceName":"Red Hat Security Data","role":"Vendor","severity":3,"title":"Red Hat: CVE-2026-111768 (important)","text":"@modelcontextprotocol/sdk: @modelcontextprotocol/server: Model Context Protocol TypeScript SDK: Denial of service via memory exhaustion from crafted HTTP requests","url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2026-111768.json"},{"at":"2026-11-05T22:17:45.457Z","source":"C6","sourceName":"NVD CVE API 2.0","role":"Database","severity":3,"title":"CVE-2026-111768 (CVSS 7.5)","text":"The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 1.3.0 until 1.32.0 in @modelcontextprotocol/sdk and from 2.0.0 until 2.3.0 in @modelcontextprotocol/server, HTTP servers did not enforce a limit on the number of array elements and object keys validated in one request. The affected surface is validation of HTTP requests containing arrays or object keys. The trigger is an array-element or object-key validation workload large enough to exhaust memory while remaining within the request size limit. A single request…","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-111768"}],"crowd":[],"reference":{"nvd":{"published":"2026-11-05T22:17:45.457","score":7.5,"severity":"HIGH","desc":"The Model Context Protocol TypeScript SDK provides TypeScript client and server implementations of the Model Context Protocol. From 1.3.0 until 1.32.0 in @modelcontextprotocol/sdk and from 2.0.0 until 2.3.0 in @modelcontextprotocol/server, HTTP servers did not enforce a limit on the number of…","product":"","seen":1793930371444},"kev":null,"epss":null,"p0":false},"mergedInto":null,"publisher":"Event Monitor Cyber"}