Evidence · DiggingBeagle record
Docker MCP Gateway crashes on malformed downstream resource URI
Primary or indexed evidence for Radar finding DB-RADAR-CP2-CP3-003. Requires control of an already enabled server; availability issue, not established credential theft.
- Source role
- primary disclosure
Evidence record
Primary or indexed evidence for Radar finding DB-RADAR-CP2-CP3-003. Requires control of an already enabled server; availability issue, not established credential theft.
Claim-level citations (3)
- supportsMalformed enabled-server metadata can crash Docker MCP Gateway: Docker reports that versions 0.14.0 through versions before 0.44.1 can terminate when an enabled downstream MCP server returns malformed resources/list URI metadata.
Description, Summary and Details
- supportsMalformed enabled-server metadata can crash Docker MCP Gateway: Docker identifies version 0.44.1 as the fix and states that no confidentiality or integrity impact was identified.
Affected versions, Patched versions and Impact
- supportsMalformed enabled-server metadata can crash Docker MCP Gateway: The 0.44.1 patch validates downstream capabilities through an isolated SDK server, recovers parser panics and omits a malformed capability rather than terminating the active gateway.
GHSA-jfp6-4vv7-6m6c, Patches