MCP web.url_read SSRF bypass via DNS rebinding and unbounded response fix in v1.7.1

Vulnerability Summary Vulnerability Overview Vulnerability Type: SSRF (Server-Side Request Forgery) Affected Component: Vulnerability Description: The URL reading functionality previously only validated literal hostnames (e.g., , , or cloud metadata endpoints ), allowing attackers to bypass SSRF protections using DNS rebinding. Following the fix, in direct (non-proxy) mode, all resolved DNS responses are validated, and the DNS rebinding window is closed before the connection is established. Related Configuration: Setting permits internal network addresses; when a URL reading proxy is configured, the proxy performs DNS resolution, and therefore deployments must rely on egress firewall controls (see ). Impact Scope Affected Versions: and earlier Fixed Version: Impact Scenarios: - Unbounded response body reading: The limit in only applied to server-side chunked transfer encoding, failed/missing HEAD responses, or response bodies larger than the reported . - After fix: Response bodies are read via a bounded stream, enforcing the (default 5 MB) limit, stopping the read before reaching the cap, without transformation or caching. Mitigation SSRF via Private Addresses in DNS Resolution: - Before fix: Only literal hostnames were validated, allowing DNS rebinding to bypass protections. - After fix: Direct mode validates all resolved DNS responses, closing the DNS rebinding window. - Proxy mode: Relies on egress firewall controls. Unbounded Response Body Reading: - Before fix: The limit only applied to server-side chunked transfer encoding, failed/missing HEAD responses, or response bodies larger than the reported . - After fix: Response bodies are read via a bounded stream, enforcing the (default 5 MB) limit, stopping the read before reaching the cap, without transformation or caching. POC Code No POC code or exploitation code is included in the documentation.

Goal Reached Thanks to every supporter — we hit 100%!

MCP web.url_read SSRF bypass via DNS rebinding and unbounded response fix in v1.7.1

More from this source