{"data":{"id":"421301c3-cce6-43b4-81fb-1c64ad459f41","title":"GHSA-xcqx-9jf5-w339:  SearXNG MCP Server: Unbounded Response Body Read Bypasses URL Size Limit in `web_url_read`","summary":"The `web_url_read` tool in mcp-searxng enforces its 5 MiB response limit only by checking the `Content-Length` header from a preliminary HEAD request. When a server omits that header, `checkContentLength()` returns `null`, the guard evaluates to `false`, and `response.text()` reads the full body with no byte cap. An unauthenticated attacker who controls or can redirect to an HTTP endpoint can force unbounded memory and CPU use, causing a Denial of Service.","solution":"Replace both `response.text()` calls with a streaming reader that aborts once the byte counter exceeds `maxContentLengthBytes`.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-xcqx-9jf5-w339","publishedAt":"2026-06-19T21:42:43.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["denial_of_service"],"issueType":"vulnerability","affectedPackages":["mcp-searxng@< 1.7.1 (fixed: 1.7.1)"],"affectedPackageNames":["mcp-searxng"],"affectedPackageRefs":["npm:mcp-searxng"],"affectedVendors":[],"affectedVendorsRaw":["SearXNG MCP Server","mcp-searxng"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-xcqx-9jf5-w339"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-06-19T21:42:43.000Z","fixReleasedAt":"2026-06-18T21:36:46.879Z","daysToFix":-1,"fixCheckedAt":"2026-10-29T21:34:02.418Z","capecIds":null,"crossRefCount":0,"attackSophistication":"trivial","impactType":["availability"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":null,"fixes":[{"ecosystem":"npm","name":"mcp-searxng","fixedVersion":"1.7.1","matchedVersion":"1.7.1","fixReleasedAt":"2026-06-18T21:36:46.879Z","daysToFix":-1,"match":"ecosystem","source":"registry","status":"found","checkedAt":"2026-10-29T21:34:02.273Z"}]}}