HIGH7.1Go
GHSA-89xv-2j6f-qhc8· CVE-2026-33252, GO-2026-4773Cross-Site Tool Execution for HTTP Servers without Authorizatrion in github.com/modelcontextprotocol/go-sdk
Modified: 9/10/2026
package
Go/github.com/modelcontextprotocol/go-sdk
pkg:go/github.com/modelcontextprotocol/go-sdk
HIGHGo
GHSA-q382-vc8q-7jhj· GO-2026-4770Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk
Modified: 9/10/2026
HIGHGo
GHSA-wvj2-96wp-fq3f· CVE-2026-27896, GO-2026-4569MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity
Modified: 9/10/2026
HIGH8.1Go
GHSA-xw59-hvm2-8pj6· CVE-2026-34742, GO-2026-5771DNS Rebinding Protection Disabled by Default in Model Context Protocol Go SDK for Servers Running on Localhost
Modified: 7/21/2026
—Go
GO-2026-4569· CVE-2026-27896, GHSA-wvj2-96wp-fq3fMCP Go SDK Vulnerable to Improper Handling of Case Sensitivity in github.com/modelcontextprotocol/go-sdk
Modified: 3/23/2026
—Go
GO-2026-4770· GHSA-q382-vc8q-7jhjImproper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk
Modified: 3/25/2026
—Go
GO-2026-4773· CVE-2026-33252, GHSA-89xv-2j6f-qhc8Cross-Site Tool Execution for HTTP Servers without Authorizatrion in github.com/modelcontextprotocol/go-sdk
Modified: 3/25/2026
—Go
GO-2026-5771· CVE-2026-34742, GHSA-xw59-hvm2-8pj6DNS Rebinding Protection Disabled by Default in Model Context Protocol Go SDK for Servers Running on Localhost in github.com/modelcontextprotocol/go-sdk
Modified: 6/25/2026