HIGHPyPI
GHSA-3qhf-m339-9g5v· CVE-2025-53366, PYSEC-2026-1616MCP Python SDK vulnerability in the FastMCP Server causes validation error, leading to DoS
Modified: 7/16/2026
package
PyPI/mcp
pkg:pypi/mcp
HIGHPyPI
GHSA-9h52-p55h-vw2f· CVE-2025-66416, PYSEC-2026-1617Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default
Modified: 9/10/2026
HIGH7.6PyPI
GHSA-hvrp-rf83-w775· CVE-2026-52870, PYSEC-2026-3481MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks
Modified: 9/10/2026
HIGHPyPI
GHSA-j975-95f5-7wqh· CVE-2025-53365, PYSEC-2026-1618MCP Python SDK has Unhandled Exception in Streamable HTTP Transport, Leading to Denial of Service
Modified: 7/16/2026
HIGH7.1PyPI
GHSA-jpw9-pfvf-9f58· CVE-2026-52869, PYSEC-2026-3482MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal
Modified: 9/10/2026
HIGHPyPI
GHSA-vj7q-gjh5-988w· CVE-2026-59950, PYSEC-2026-3483MCP Python SDK: WebSocket server transport does not support Host/Origin validation
Modified: 9/10/2026
—PyPI
PYSEC-2026-1616· CVE-2025-53366, GHSA-3qhf-m339-9g5vMCP Python SDK vulnerability in the FastMCP Server causes validation error, leading to DoS
Modified: 7/7/2026
—PyPI
PYSEC-2026-1617· CVE-2025-66416, GHSA-9h52-p55h-vw2fModel Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default
Modified: 7/7/2026
—PyPI
PYSEC-2026-1618· CVE-2025-53365, GHSA-j975-95f5-7wqhMCP Python SDK has Unhandled Exception in Streamable HTTP Transport, Leading to Denial of Service
Modified: 7/7/2026
HIGH7.6PyPI
PYSEC-2026-3481· CVE-2026-52870, GHSA-hvrp-rf83-w775MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks
Modified: 7/23/2026
HIGH7.1PyPI
PYSEC-2026-3482· CVE-2026-52869, GHSA-jpw9-pfvf-9f58MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal
Modified: 7/23/2026
—PyPI
PYSEC-2026-3483· CVE-2026-59950, GHSA-vj7q-gjh5-988wMCP Python SDK: WebSocket server transport does not support Host/Origin validation
Modified: 7/23/2026