VDB
Sign up
HIGH

GHSA-q382-vc8q-7jhj

Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk

Quick fix

GHSA-q382-vc8q-7jhj — github.com/modelcontextprotocol/go-sdk: upgrade to the fixed version with the command below.

go get github.com/modelcontextprotocol/go-sdk@v1.4.1

Details

The Go SDK recently transitioned to the `segmentio/encoding` library for JSON parsing in version 1.3.1. While this change addressed both case-insensitivity and ASCII folding issues, the new parser implemented aggressive key matching that treated keys with `null` Unicode characters appended at the end as equivalent to their base strings.

#### Impact

When combined with duplicate keys, the described behavior leads to a "last key wins" resolution that could override the intended MCP message. This had the potential for: - **Bypassing intermediary inspection:** Proxies or policy layers that matched on exact field names may have failed to detect or filter these messages. - **Cross-implementation inconsistency:** Other MCP SDKs (TypeScript, Python) use case-sensitive parsing and would reject the same messages, creating potential security-boundary confusion.

#### Fix:

The `segmentio/encoding` package was patched with a fix in https://github.com/segmentio/encoding/commit/7d5a25dbc5da13aed3cb047a127e4d0e96f536fb and a new version of the package was released (`v0.5.4`). The SDK switched to the patched version of the dependency in 724dd47aa. Users are advised to update to v1.4.1 to resolve this issue.

#### Credits: Thank you to Francesco Lacerenza (Doyensec) for reporting this issue.

Are you affected?

Enter the version of the package you're using.

Affected packages

Go/github.com/modelcontextprotocol/go-sdk
Introduced in: 0Fixed in: 1.4.1
Fixgo get github.com/modelcontextprotocol/go-sdk@v1.4.1

References