—

GO-2026-5771

DNS Rebinding Protection Disabled by Default in Model Context Protocol Go SDK for Servers Running on Localhost in github.com/modelcontextprotocol/go-sdk

Quick fix

GO-2026-5771 — github.com/modelcontextprotocol/go-sdk: upgrade to the fixed version with the command below.

go get github.com/modelcontextprotocol/go-sdk@v1.4.0

Details

DNS Rebinding Protection Disabled by Default in Model Context Protocol Go SDK for Servers Running on Localhost in github.com/modelcontextprotocol/go-sdk

Are you affected?

Enter the version of the package you're using.

Affected packages

Go / github.com/modelcontextprotocol/go-sdk

Introduced in: 0 Fixed in: 1.4.0

Fix go get github.com/modelcontextprotocol/go-sdk@v1.4.0

References

https://github.com/modelcontextprotocol/go-sdk/security/advisories/GHSA-xw59-hvm2-8pj6 [ADVISORY]
https://nvd.nist.gov/vuln/detail/CVE-2026-34742 [ADVISORY]
https://github.com/modelcontextprotocol/go-sdk/commit/67bd3f2e2b53ce11a16db8d976cdb8ff1e986b6d [FIX]
https://github.com/modelcontextprotocol/go-sdk/pull/760 [FIX]
https://github.com/modelcontextprotocol/go-sdk/releases/tag/v1.4.0 [WEB]