PyPI/mcp CVE-2026-59951: high 7.5
MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion
Action: Upgrade mcp to 1.30.0 or later.
pip install mcp==1.30.0pip install mcp==2.2.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.8.0 | 1.30.0 | - |
| 2.0.0 | 2.2.0 | - |
Fixed versions
| 1.30.0 | 2.2.0 |
Sources
- osv: GHSA-84m7-p3x7-pcfv
- https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-84m7-p3x7-pcfv
- https://nvd.nist.gov/vuln/detail/CVE-2026-59951
- https://github.com/modelcontextprotocol/python-sdk/pull/3395
- https://github.com/modelcontextprotocol/python-sdk/pull/3426
- https://github.com/modelcontextprotocol/python-sdk/commit/92120b4b0f50385af096592d7cee932fc1d994e7
- https://github.com/modelcontextprotocol/python-sdk/commit/d2290ca3434731b68ea3e2270bc06a6e6575931b
- https://github.com/modelcontextprotocol/python-sdk
- https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.30.0
- https://github.com/modelcontextprotocol/python-sdk/releases/tag/v2.2.0
CVE-2026-59951 · published · modified · JSON