{"action":"Upgrade rmcp to 1.4.0 or later.","affected":[{"fixed":"1.4.0","introduced":"0.0.0-0"}],"component":"rmcp","cve_ids":["CVE-2026-42559"],"ecosystem":"crates.io","epss":0.00269,"exploited":false,"fixed_versions":["1.4.0"],"ghsa_id":"GHSA-89vp-x53w-74fx","id":"tcs_01M5KFBQCVB7V7QWM3QGV93YSM","modified_at":"2026-10-12T18:00:14.804412378Z","published_at":"2026-04-29T12:00:00Z","references":["https://osv.dev/vulnerability/RUSTSEC-2026-0189","https://crates.io/crates/rmcp","https://rustsec.org/advisories/RUSTSEC-2026-0189.html","https://github.com/modelcontextprotocol/rust-sdk/issues/815","https://github.com/modelcontextprotocol/rust-sdk/pull/764","https://github.com/modelcontextprotocol/rust-sdk/issues/822","https://modelcontextprotocol.io/specification/2025-06-18/basic/transports#security-warning"],"severity":{"label":"high","score":8.8},"sources":[{"source":"osv","source_id":"RUSTSEC-2026-0189","url":"https://osv.dev/vulnerability/RUSTSEC-2026-0189"}],"summary":"DNS rebinding vulnerability in rmcp Streamable HTTP server transport"}