PyPI/mcp CVE-2025-66416: high 8.1, EPSS 0.51%

Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default

Action: Upgrade mcp to 1.23.0 or later.

pip install mcp==1.23.0

Affected

Fixed versions

Sources

• osv: PYSEC-2026-1617
• nvd: CVE-2025-66416
• https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-9h52-p55h-vw2f
• https://github.com/modelcontextprotocol/python-sdk/commit/d3a184119e4479ea6a63590bc41f01dc06e3fa99
• https://github.com/modelcontextprotocol/python-sdk
• https://pypi.org/project/mcp
• https://github.com/advisories/GHSA-9h52-p55h-vw2f

CVE-2025-66416 · published 2026-07-07T16:03:11.859199Z · modified 2026-07-07T17:47:04.409703799Z · JSON