{"action":"Upgrade mcp to 1.10.0 or later.","affected":[{"fixed":"1.10.0","introduced":"0"}],"component":"mcp","cve_ids":["CVE-2025-53365"],"ecosystem":"PyPI","epss":0.00419,"exploited":false,"fixed_versions":["1.10.0"],"ghsa_id":"GHSA-j975-95f5-7wqh","id":"tcs_01M5KFNJ78BYET6RHG1NATV0F7","modified_at":"2026-07-16T18:45:48.211743797Z","published_at":"2025-07-04T22:06:31Z","references":["https://osv.dev/vulnerability/GHSA-j975-95f5-7wqh","https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-j975-95f5-7wqh","https://nvd.nist.gov/vuln/detail/CVE-2025-53365","https://github.com/modelcontextprotocol/python-sdk/pull/967","https://github.com/modelcontextprotocol/python-sdk/commit/7b420656de48cfdb90b39eb582e60b6d55c2f891","https://github.com/advisories/GHSA-j975-95f5-7wqh","https://github.com/modelcontextprotocol/python-sdk","https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.10.0","https://github.com/pypa/advisory-database/tree/main/vulns/mcp/PYSEC-2026-1618.yaml","https://pypi.org/project/mcp"],"severity":{"label":"high","score":8.7},"sources":[{"source":"osv","source_id":"GHSA-j975-95f5-7wqh","url":"https://osv.dev/vulnerability/GHSA-j975-95f5-7wqh"},{"source":"nvd","source_id":"CVE-2025-53365","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53365"}],"summary":"MCP Python SDK has Unhandled Exception in Streamable HTTP Transport, Leading to Denial of Service"}