CVE-2026-111768

This vulnerability is rated as having Important impact because an unauthenticated remote attacker can trigger complete service unavailability through process termination via a single HTTP request that conforms to default body size limits. Deployments utilizing the stdio transport are unaffected, as the vulnerability is strictly confined to HTTP-based transport mechanisms. In environments exposing HTTP endpoints, the risk is elevated when services expose tools accepting array or dictionary structures without preceding upstream authentication or strict reverse-proxy payload size constraints.

To mitigate this vulnerability without applying code changes, implement one or more of the following operational controls:

1. Restrict transport exposure:

Run Model Context Protocol services using the stdio transport instead of HTTP where feasible. If HTTP endpoints are required, restrict network access to trusted hosts using network firewall rules or access control lists.

2. Enforce request body size limits at the reverse proxy or API gateway:

Place the application behind a reverse proxy (such as NGINX or Apache HTTP Server) or ingress controller and reduce the maximum permitted request body size to the minimum required for expected traffic. For example, in an upstream NGINX configuration:

```

client_max_body_size 256k;

```

Warning: Modifying reverse proxy or firewall configurations may require reloading or restarting the service (for example, `systemctl reload nginx`), which can cause temporary interruptions to active network sessions. Ensure the chosen payload limit is tested to avoid dropping valid application requests.