Go/github.com/docker/mcp-gateway CVE-2025-64443: critical 9.6, EPSS 0.43%
Docker MCP Plugin and Docker MCP Gateway have DNS Rebinding vulnerability when running in sse or streaming mode in github.com/docker/mcp-gateway
Action: Upgrade github.com/docker/mcp-gateway to 0.28.0 or later.
go get github.com/docker/mcp-gateway@v0.28.0Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 0.28.0 | - |
Fixed versions
| 0.28.0 |
Sources
- osv: GO-2025-4179
- nvd: CVE-2025-64443
- https://github.com/docker/mcp-gateway/security/advisories/GHSA-46gc-mwh4-cc5r
- https://github.com/docker/mcp-gateway/commit/6b076b2479d8d1345c50c112119c62978d46858e
- https://github.com/docker/mcp-gateway/commit/fe073985c8eb6e0c9317d2f198c07686f70ea06d
- https://github.com/docker/mcp-gateway/pull/190
- https://modelcontextprotocol.io/specification/2025-06-18/basic/transports#security-warning
CVE-2025-64443 · published · modified · JSON