CVE-2026-59951Medium· 6.9▾ SunlitThe MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.8.0 until 1.30.0 and 2.2.0, stateful Streamable HTTP servers, including FastMCP, MCPServer, Server.streamable_http_app(), and …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 38 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Oct 16.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
— → 6.9
none → medium
Last analysed / modified upstream
0.5%
The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.8.0 until 1.30.0 and 2.2.0, stateful Streamable HTTP servers, including FastMCP, MCPServer, Server.streamable_http_app(), and StreamableHTTPSessionManager, retain session entries without an idle expiration or aggregate session-count limit. DELETE, refused opening requests, and completed sessions do not reliably discard their entries, and each entry can retain parsed initialize parameters. A client that can reach the endpoint can therefore create ordinary short requests that grow server memory without bound until restart. Stateless HTTP, stdio, and SSE transports are not affected. This issue is fixed in versions 1.30.0 and 2.2.0.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
mcp >= 1.8.0, < 1.30.0mcp >= 2.0.0, < 2.2.0Patched in:
mcp 1.30.0mcp 2.2.0Source: https://github.com/advisories/GHSA-84m7-p3x7-pcfv
Field changes observed since this record was first indexed.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-63128High· 7.5RMCP is an official Rust SDK for the Model Context Protocol
CVE-2026-109527High· 7.5The Model Context Protocol Python SDK is the official Python SDK for Model Context Protocol servers and clients
CVE-2026-64684Medium· 6.8RMCP is an official Rust SDK for the Model Context Protocol
CVE-2026-63127High· 8.2RMCP is an official Rust SDK for the Model Context Protocol
CVE-2026-53937Medium· 6.2MCP Kotlin SDK is the Kotlin Multiplatform software development kit for the Model Context Protocol
CVE-2026-104850High· 7.5MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients