Resource exhaustion

What it is

Resource exhaustion covers the CPU, memory, disk, and connection-pool versions of the same bug: the handler trusts an input to stay small. Classic shapes are `range(n)` with attacker-controlled `n`, regular-expression backtracking on untrusted input (ReDoS), image decoding without a pixel-count cap, and recursion on user-supplied data structures.

Why it matters for MCP

MCP servers are long-lived processes shared across the user's entire session. Crashing them is not a restart-and-recover inconvenience — it takes the whole agent workflow with it. A model that enters a loop of "try a bigger batch size," driven by a buggy tool description, can exhaust the host without any malice at all.

Vulnerable example

server.tool("expand_range", { n: z.number() }, async ({ n }) => {

  const items = Array.from({ length: n }, (_, i) => i);

  return { content: [{ type: "text", text: JSON.stringify(items) }] };

});

Secure example

const MAX_ITEMS = 1_000;

server.tool("expand_range", { n: z.number().int().positive().max(MAX_ITEMS) }, async ({ n }) => {

  const items = Array.from({ length: n }, (_, i) => i);

  return { content: [{ type: "text", text: JSON.stringify(items) }] };

});

How MCPSafe detects this

We look for unbounded loops, allocations, and regular-expression evaluation driven by handler parameters. Schemas without `max` / `maxLength` / `maxItems` are surfaced for inputs that flow into allocators.

See the full threat catalog for every documented detection.

Framework alignment

OWASP LLM Top-10 (2025)

LLM10 — Unbounded Consumption

OWASP Agentic AI Top-10

T04 — Resource Overload

AIVSS v0.5

5.9 (MEDIUM)AIVSS:1.0/S:MEDIUM/AV:N/AU:L/BR:M/CD:D

Illustrative CVEs

CVEs of the same CWE class. Not MCP-specific, but exemplify the failure mode MCPSafe detects.

• CVE-2022-25881 — http-cache-semantics ReDoS — unbounded regex on user input

Further reading

• CWE-400: Uncontrolled Resource Consumption
• OWASP ReDoS