MCP SDKs
Filed as: mcp gem, Model Context Protocol, RMCP, mcp, MCP Python SDK, MCP Inspector, MCP Java SDK, MCP TypeScript SDK, Model Context Protocol Python SDK, @modelcontextprotocol/sdk, Go MCP SDK, MCP Kotlin SDK, and 5 more
Records
33
Disclosed CVEs
31
Exploited (sev 3–4)
0
CISA KEV flagged
0
Newest record 2026-10-14 · 31 distinct CVE ids · open in the explorer (the explorer matches the first product a record names, so it can list fewer)
Patch now: confirmed exploitation or KEV · 0
Records at severity 3–4 (exploitation confirmed by CISA, the vendor or reporting) and records flagged as listed in CISA KEV. The KEV flag is the classifier’s cisa-kev tag or a source on the KEV catalog; it is recorded when the collector sees the listing, so a missing flag does not mean a CVE is absent from the catalog.
No record for MCP SDKs has confirmed exploitation or a KEV flag.
Disclosures by month · last 24 months
▁▂ ▁ ▂▁▁▂▂▁▁█▁▄▄
Nov ’2431 disclosed · peak 8 in Jul ’26Oct ’26
Disclosed CVEs, no confirmed exploitation · 31
- 2026-10-14CVE-2026-59951Model Context Protocol Python SDK Unbounded Session Accumulation Flaw2 Disclosedmcp · resource-exhaustion
- 2026-10-14CVE-2026-108395Model Context Protocol Java SDK Unbounded Request Body Vulnerability2 Disclosedmcp · java
- 2026-10-14CVE-2026-109527Model Context Protocol Python SDK Unbounded HTTP Body Memory Buffer Vulnerability2 Disclosedmcp · dos
- 2026-10-06CVE-2026-104850MCP TypeScript SDK OAuth Client Credential Exposure Vulnerability2 Disclosedmcp · oauth
- 2026-09-16
- 2026-09-16
- 2026-09-16CVE-2026-64684RMCP Rust SDK Leaks Custom Headers on Cross-Origin Redirects2 Disclosedmcp · rust · sdk
- 2026-09-09CVE-2026-53937MCP Kotlin SDK vulnerable to buffer growth denial of service2 Disclosedmcp · memory-exhaustion
- 2026-08-25CVE-2026-53965CVE-2026-53965: MCP PHP SDK unbounded memory buffer vulnerability2 Disclosedmcp · infra_vuln
- 2026-07-29CVE-2026-63119CVE-2026-63119: Unbounded IO Read Vulnerability in MCP Ruby SDK2 Disclosedmcp · denial-of-service
- 2026-07-29CVE-2026-67432CVE-2026-67432: Unbounded JSON-RPC Request Vulnerability in MCP Ruby SDK2 Disclosedmcp · denial-of-service
- 2026-07-29CVE-2026-67430CVE-2026-67430: Memory Exhaustion Vulnerability in MCP Ruby SDK2 Disclosedmcp · denial-of-service
- 2026-07-29CVE-2026-67431CVE-2026-67431: Session Hijacking Vulnerability in MCP Ruby SDK2 Disclosedmcp · session-hijacking
- 2026-07-29CVE-2026-63118CVE-2026-63118: DNS Rebinding Vulnerability in MCP Ruby SDK2 Disclosedmcp · dns-rebinding
- 2026-07-15CVE-2026-59950CVE-2026-59950: MCP Python SDK WebSocket server lacks Host and Origin validation2 Disclosedmcp · websocket
- 2026-07-15CVE-2026-52869CVE-2026-52869: MCP Python SDK HTTP transports fail to verify authenticated principal2 Disclosedmcp · authentication
- 2026-07-15CVE-2026-52870CVE-2026-52870: MCP Python SDK experimental task handlers allow unauthorized task access2 Disclosedmcp · authorization
- 2026-06-13CVE-2026-11624CVE-2026-11624: Model Context Protocol lacks Origin header validation allowing DNS rebinding2 Disclosedmcp · dns-rebinding
- 2026-05-14CVE-2026-42559CVE-2026-42559: RMCP Streamable HTTP Server Host Header Validation Flaw2 Discloseddns-rebinding · model-context-protocol
- 2026-04-07CVE-2026-35568CVE-2026-35568: DNS rebinding vulnerability in MCP Java SDK2 Discloseddns-rebinding · mcp
- 2026-04-02CVE-2026-34742CVE-2026-34742: DNS Rebinding Vulnerability in Go MCP SDK2 Discloseddns-rebinding · mcp
- 2026-03-31CVE-2026-34237CVE-2026-34237: Hardcoded Wildcard CORS Vulnerability in MCP Java SDK2 Disclosedcors · mcp
- 2026-03-27CVE-2026-33946CVE-2026-33946: MCP Ruby SDK session hijacking vulnerability2 Disclosedsession-hijacking · mcp
- 2026-02-04CVE-2026-25536CVE-2026-25536: Model Context Protocol SDK cross-client data leak2 Disclosedmcp · data_leak
- 2026-01-05CVE-2026-0621CVE-2026-0621: Anthropic's MCP TypeScript SDK has a ReDoS vulnerability2 Disclosedmcp · anthropic · redos
- 2025-12-02CVE-2025-66416CVE-2025-66416: MCP Python SDK lacks default DNS rebinding protection2 Discloseddns-rebinding
- 2025-12-02CVE-2025-66414CVE-2025-66414: MCP TypeScript SDK lacks default DNS rebinding protection2 Discloseddns-rebinding
- 2025-09-08CVE-2025-58444CVE-2025-58444: MCP Inspector Vulnerable to Command Execution via XSS2 Disclosedxss · mcp
- 2025-07-04CVE-2025-53366CVE-2025-53366: MCP Python SDK FastMCP Server Denial of Service Vulnerability2 Disclosedmcp · dos
- 2025-07-04CVE-2025-53365CVE-2025-53365: MCP Python SDK Denial of Service via Streamable HTTP Transport2 Disclosedmcp · dos
- 2025-06-13
Other incidents: research and unexploited reports · 2
- 2026-03-31Credential Exfiltration via Remote Poisoned MCP Tool1 Researchmcp · prompt-injection · data-exfiltration
- 2026-01-30Data Exfiltration via MCP Server Prompt Injection Targeting Cursor1 Researchmcp · prompt_injection · cursor · data_leak
This page lists what has been reported, not what to do about it. Versions and fixes are in each linked advisory; check the vendor’s own advisory before acting.