What’s Vulnerable › Products

modelcontextprotocol python-sdk vulnerabilities

8 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.

Check whether your modelcontextprotocol python-sdk version is affected

Latest modelcontextprotocol python-sdk vulnerabilities

• CVE-2026-109527 — Model Context Protocol Python SDK HTTP and OAuth endpoints allow memory exhaustion through unbounded request bodies (CVSS 7.5)
• CVE-2026-59951 — MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion (CVSS 6.9)
• CVE-2026-59950 — MCP Python SDK: WebSocket server transport does not support Host/Origin validation (CVSS 8.1)
• CVE-2026-52870 — MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks (CVSS 7.6)
• CVE-2026-52869 — MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal (CVSS 7.1)
• CVE-2025-66416 — DNS Rebinding Protection Disabled by Default in Model Context Protocol Python SDK for Servers Running on Localhost (CVSS 8.1)
• CVE-2025-53366 — MCP SDK Vulnerable to FastMCP Server Validation Error, Leading to Denial of Service (CVSS 8.7)
• CVE-2025-53365 — MCP Python SDK has Unhandled Exception in Streamable HTTP Transport ,Leading to Denial of Service (CVSS 8.7)