security(mcp-kb): Add content size limits to prevent DoS attacks #78

New Issue

cardosofelipe · 2026-01-03T23:57:03Z

cardosofelipe commented

2026-01-03 23:57:03 +00:00

Security Issue

The Knowledge Base MCP server has no content size limits, making it vulnerable to DoS attacks via memory exhaustion.

Vulnerable Endpoints

add_document: No limit on content size
batch_add_documents: No limit on batch size or total content
update_document: No limit on new content size

Attack Vector

An attacker could:

Submit extremely large documents (hundreds of MB)
Submit thousands of documents in a single batch
Exhaust server memory and crash the service

Fix Required

Add MAX_DOCUMENT_SIZE config (e.g., 10MB)
Add MAX_BATCH_SIZE config (e.g., 100 documents)
Add MAX_TOTAL_BATCH_SIZE config (e.g., 50MB)
Validate content size before processing
Return 413 Payload Too Large for oversized requests

Implementation

# config.py
MAX_DOCUMENT_SIZE: int = 10 * 1024 * 1024  # 10MB
MAX_BATCH_SIZE: int = 100
MAX_BATCH_TOTAL_SIZE: int = 50 * 1024 * 1024  # 50MB

# server.py - validate before processing
if len(content.encode()) > settings.MAX_DOCUMENT_SIZE:
    raise ValueError(f"Content exceeds maximum size of {settings.MAX_DOCUMENT_SIZE} bytes")

Found during PR #72 security review
Issue #57 (Knowledge Base MCP Server)
OWASP: Denial of Service

## Security Issue The Knowledge Base MCP server has no content size limits, making it vulnerable to DoS attacks via memory exhaustion. ### Vulnerable Endpoints 1. **add_document**: No limit on content size 2. **batch_add_documents**: No limit on batch size or total content 3. **update_document**: No limit on new content size ### Attack Vector An attacker could: 1. Submit extremely large documents (hundreds of MB) 2. Submit thousands of documents in a single batch 3. Exhaust server memory and crash the service ### Fix Required 1. Add `MAX_DOCUMENT_SIZE` config (e.g., 10MB) 2. Add `MAX_BATCH_SIZE` config (e.g., 100 documents) 3. Add `MAX_TOTAL_BATCH_SIZE` config (e.g., 50MB) 4. Validate content size before processing 5. Return 413 Payload Too Large for oversized requests ### Implementation ```python # config.py MAX_DOCUMENT_SIZE: int = 10 * 1024 * 1024 # 10MB MAX_BATCH_SIZE: int = 100 MAX_BATCH_TOTAL_SIZE: int = 50 * 1024 * 1024 # 50MB # server.py - validate before processing if len(content.encode()) > settings.MAX_DOCUMENT_SIZE: raise ValueError(f"Content exceeds maximum size of {settings.MAX_DOCUMENT_SIZE} bytes") ``` ### Related - Found during PR #72 security review - Issue #57 (Knowledge Base MCP Server) - OWASP: Denial of Service

cardosofelipe closed this issue

2026-01-04 00:03:42 +00:00

cardosofelipe referenced this issue from a commit

2026-01-04 00:08:59 +00:00

fix(mcp-kb): address critical issues from deep review

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: cardosofelipe/syndarix#78