From Dev.to
The first of its kind: how one unbounded request body became a denial-of-service class across every major MCP SDK
The one-line version In April 2026 I reported CVE-2026-39313, a denial-of-service flaw in an MCP server framework. It was the first CVE of its kind: an unbounded HTTP request body, CWE-770, that let...