Skip to content

v1.2

Choose a tag to compare

View all tags
@duty1g duty1g released this 27 Aug 07:00
· 4 commits to main since this release
v1.2
0dd4204

Security Fixes

  • Fix pre-auth DoS via Content-Length overflow (GHSA-jgj3-97w2-9v9r) — A crafted Content-Length header with a near-max integer value caused an integer overflow panic in the HTTP receive path, crashing the entire x64dbg process. The overflow occurred before authentication, making it exploitable without a valid token. Fixed by using saturating addition (+|) so the overflow safely saturates instead of panicking.

  • Default bind address changed to 127.0.0.1 — The server now binds to localhost by default, reducing network exposure. Set the bind address to 0.0.0.0 in the config dialog if you need WSL or remote access.

Upgrade

Extract x64dbg-MCP-Server.zip into your x64dbg root folder. If you previously configured 0.0.0.0 as the bind address, your setting is preserved — this change only affects fresh installs or reset configs.

Assets 3
Loading