PyPI/mcp CVE-2025-53366: high 8.7, EPSS 9.75%

MCP Python SDK vulnerability in the FastMCP Server causes validation error, leading to DoS

Action: Upgrade mcp to 1.9.4 or later.

pip install mcp==1.9.4

Affected

Fixed versions

Sources

• osv: PYSEC-2026-1616
• nvd: CVE-2025-53366
• https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-3qhf-m339-9g5v
• https://github.com/modelcontextprotocol/python-sdk/pull/822
• https://github.com/modelcontextprotocol/python-sdk/commit/29c69e6a47d0104d0afcea6ac35e7ab02fde809a
• https://github.com/modelcontextprotocol/python-sdk
• https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.9.4
• https://pypi.org/project/mcp
• https://github.com/advisories/GHSA-3qhf-m339-9g5v

CVE-2025-53366 · published 2026-07-07T16:02:56.172263Z · modified 2026-07-07T17:47:03.420621263Z · JSON