{"metadata": {"vulnerability": "CVE-2026-108859", "count": 12, "kinds": {"milestone": 4, "sighting": 2, "kev": 0, "other": 6}}, "data": [{"timestamp": "2026-10-11T00:00:00Z", "date_only": false, "value": "2026-10-11T00:00:00.000Z", "kind": "other", "label": "Made public", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-108859", "field": "containers.cna.datePublic"}, {"timestamp": "2026-10-11T13:06:49.278Z", "date_only": false, "value": "2026-10-11T13:06:49.278Z", "kind": "milestone", "label": "Reserved", "source": "cvelistv5", "record": "CVE-2026-108859", "field": "cveMetadata.dateReserved"}, {"timestamp": "2026-10-11T13:26:06.450Z", "date_only": false, "value": "2026-10-11T13:26:06.450Z", "kind": "milestone", "label": "Published", "source": "cvelistv5", "record": "CVE-2026-108859", "field": "cveMetadata.datePublished"}, {"timestamp": "2026-10-11T13:26:06.450Z", "date_only": false, "value": "2026-10-11T13:26:06.450Z", "kind": "other", "label": "Updated", "source": "cvelistv5", "record": "CVE-2026-108859", "field": "cveMetadata.dateUpdated"}, {"timestamp": "2026-10-11T13:26:06.450Z", "date_only": false, "value": "2026-10-11T13:26:06.450Z", "kind": "other", "label": "Updated", "source": "cvelistv5 / VulnCheck", "record": "CVE-2026-108859", "field": "containers.cna.providerMetadata.dateUpdated"}, {"timestamp": "2026-10-11T13:43:42.372Z", "date_only": false, "value": "2026-10-11T13:43:42.372797Z", "kind": "sighting", "label": "Seen", "source": "https://infosec.exchange/users/cve/statuses/117422569674493165", "record": "CVE-2026-108859", "field": "creation_timestamp", "uuid": "1619db31-2e69-4cc0-b27b-ed4d7f478b6a", "content": "CVE-2026-108859 mcp-go through 1.2.1 Denial of Service via Unbounded POST Body Buffering mcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP that allows remote unauthenticated attackers to exhaust memory by sending oversized POST bodies. Attackers can send arbitrarily large or many concurrent POST requests, read fully via io.ReadAll before validation, to degrade or OOM-kill the server process.\nhttps://www.cve.org/CVERecord?id=CVE-2026-108859https://hackmd.io/@1ExmmukzRMWN7B4gQ4W-4Q/mark3labs-mcp-go-streamable-http-unbounded-bodyhttps://github.com/mark3labs/mcp-go/blob/90d247ed8d45cbb7d71d9a95e112789b78760443/server/streamable_http.go#L405-L411https://github.com/mark3labs/mcp-gohttps://www.vulncheck.com/advisories/mcp-go-through-1.2.1-denial-of-service-via-unbounded-post-body-buffering#mark3labs #mcp-go#CVE_2026_108859#bot", "url": "https://infosec.exchange/users/cve/statuses/117422569674493165"}, {"timestamp": "2026-10-11T14:17:05Z", "date_only": false, "value": "2026-10-11T14:17:05Z", "kind": "other", "label": "Nvd published at", "source": "github \u00b7 GHSA-C673-PPXX-9WVJ", "record": "GHSA-C673-PPXX-9WVJ", "field": "database_specific.nvd_published_at"}, {"timestamp": "2026-10-11T14:17:05.780Z", "date_only": false, "value": "2026-10-11T14:17:05.780", "kind": "milestone", "label": "Published", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-108859", "record": "FKIE_CVE-2026-108859", "field": "published"}, {"timestamp": "2026-10-11T14:17:05.893Z", "date_only": false, "value": "2026-10-11T14:17:05.893", "kind": "other", "label": "Updated", "source": "fkie_nvd \u00b7 FKIE_CVE-2026-108859", "record": "FKIE_CVE-2026-108859", "field": "lastModified"}, {"timestamp": "2026-10-11T15:31:08Z", "date_only": false, "value": "2026-10-11T15:31:08Z", "kind": "milestone", "label": "Published", "source": "github \u00b7 GHSA-C673-PPXX-9WVJ", "record": "GHSA-C673-PPXX-9WVJ", "field": "published"}, {"timestamp": "2026-10-11T15:31:08Z", "date_only": false, "value": "2026-10-11T15:31:08Z", "kind": "other", "label": "Updated", "source": "github \u00b7 GHSA-C673-PPXX-9WVJ", "record": "GHSA-C673-PPXX-9WVJ", "field": "modified"}, {"timestamp": "2026-10-11T19:17:06.362Z", "date_only": false, "value": "2026-10-11T19:17:06.362740Z", "kind": "sighting", "label": "Seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxmpqonbsu2k", "record": "CVE-2026-108859", "field": "creation_timestamp", "uuid": "2aa7c615-c675-46d8-b8a8-bffa541f8a9b", "content": "\ud83d\udfe0 CVE-2026-108859 - High (7.5)\n\nmcp-go through 1.2.1 contains a denial of service vulnerability in StreamableHTTPServer.ServeHTTP...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-108859/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "url": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mxmpqonbsu2k"}]}