{
 "id": "AIR-2026-0139",
 "slug": "cve-2026-63128-rmcp-streamable-http-server-session-leak",
 "title": "CVE-2026-63128: RMCP Streamable HTTP server session leak",
 "summary": "The stateful Streamable HTTP server in RMCP prior to 2.0.0 fails to properly clean up sessions on early validation failure. Unauthenticated clients can trigger resource leaks by sending improperly formatted initialization requests.",
 "type": "attack_on_ai",
 "categories": [
  "infra_vuln"
 ],
 "severity": 2,
 "targets": [
  "framework_or_tooling"
 ],
 "products": [
  "RMCP"
 ],
 "incident_date": "2026-09-16",
 "incident_date_precision": "day",
 "first_reported": "2026-09-16",
 "sources": [
  {
   "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63128",
   "publisher": "NVD",
   "title": "CVE-2026-63128: RMCP is an official Rust SDK for the Model Context Protocol.",
   "published_at": "2026-09-16"
  }
 ],
 "source_count": 1,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_nvd",
 "tags": [
  "CVE-2026-63128",
  "mcp",
  "memory-leak"
 ],
 "created_at": "2026-10-18T06:33:31.967Z",
 "updated_at": "2026-10-18T06:33:31.967Z"
}