CVE-2026-59951
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk38th percentile - higher than 38% of all known CVEs
Summary
The MCP Python SDK (mcp on PyPI) from 1.8.0 until 1.30.0 and 2.2.0 does not reliably discard session entries in stateful Streamable HTTP servers, including FastMCP, MCPServer, Server.streamable_http_app(), and StreamableHTTPSessionManager. A client that can reach the endpoint can send ordinary short requests that grow server memory without bound until restart. Stateless HTTP, stdio, and SSE transports are not affected.
Risk Assessment
An attacker with network access to the endpoint can exhaust server memory, causing a crash or forced restart. This results in denial of service for legitimate MCP clients.
Recommendation
Upgrade the mcp package to version 1.30.0 or 2.2.0. Consider restricting network access to Streamable HTTP servers and monitoring memory usage.
Other vulnerabilities in MCP Python SDK
See all- CVE-2026-59950High
A vulnerability in the MCP Python SDK (mcp) prior to version 1.28.1 affects the deprecated WebSocket transport, which did not validate Host or Origin headers. This allowed arbitrary third parties to establish WebSocket connections to applications using that transport.
- CVE-2026-52870High
A vulnerability in the MCP Python SDK (mcp) versions 1.23.0 through 1.27.2 allows any client to access other clients' tasks. Default handlers for task operations do not verify the session, enabling enumeration, reading results, consuming messages, or canceling tasks of other clients.
- CVE-2026-52869High
A vulnerability in MCP Python SDK (mcp) before version 1.27.2 allows an attacker to inject JSON-RPC messages into an existing session. The issue affects SSE and Streamable HTTP transports, which do not verify the authenticated client's identity when using the session_id parameter or Mcp-Session-Id header.
Original NVD description (English source)
The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.8.0 until 1.30.0 and 2.2.0, stateful Streamable HTTP servers, including FastMCP, MCPServer, Server.streamable_http_app(), and StreamableHTTPSessionManager, retain session entries without an idle expiration or aggregate session-count limit. DELETE, refused opening requests, and completed sessions do not reliably discard their entries, and each entry can retain parsed initialize parameters. A client that can reach the endpoint can therefore create ordinary short requests that grow server memory without bound until restart. Stateless HTTP, stdio, and SSE transports are not affected. This issue is fixed in versions 1.30.0 and 2.2.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS