{
 "id": "AIR-2026-0323",
 "slug": "model-context-protocol-java-sdk-unbounded-request-body-vulne",
 "title": "Model Context Protocol Java SDK Unbounded Request Body Vulnerability",
 "summary": "The Model Context Protocol Java SDK fails to enforce size limits on HTTP request bodies across multiple transports, enabling remote memory exhaustion. Vendors have issued updates to resolve the flaw.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "Model Context Protocol Java SDK"
 ],
 "incident_date": "2026-10-14",
 "incident_date_precision": "day",
 "first_reported": "2026-10-14",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108395",
   "publisher": "NVD",
   "title": "CVE-2026-108395: The Model Context Protocol Java SDK is the official Java SDK for Model Context Protocol servers and clients.",
   "published_at": "2026-10-14"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-108395",
  "mcp",
  "java"
 ],
 "created_at": "2026-10-18T06:33:31.967Z",
 "updated_at": "2026-10-18T06:33:31.967Z"
}