{"action":"Upgrade mcp to 1.10.0 or later.","affected":[{"fixed":"1.10.0","introduced":"0"}],"component":"mcp","cve_ids":["CVE-2025-53365"],"ecosystem":"PyPI","epss":0.00419,"exploited":false,"fixed_versions":["1.10.0"],"ghsa_id":"GHSA-j975-95f5-7wqh","id":"tcs_01M5KGTP0ZQ2GGPGPYM4XTBR0K","modified_at":"2026-07-07T17:47:04.395676741Z","published_at":"2026-07-07T16:02:56.105116Z","references":["https://osv.dev/vulnerability/PYSEC-2026-1618","https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-j975-95f5-7wqh","https://nvd.nist.gov/vuln/detail/CVE-2025-53365","https://github.com/modelcontextprotocol/python-sdk/pull/967","https://github.com/modelcontextprotocol/python-sdk/commit/7b420656de48cfdb90b39eb582e60b6d55c2f891","https://github.com/modelcontextprotocol/python-sdk","https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.10.0","https://pypi.org/project/mcp","https://github.com/advisories/GHSA-j975-95f5-7wqh"],"severity":{"label":"high","score":8.7},"sources":[{"source":"osv","source_id":"PYSEC-2026-1618","url":"https://osv.dev/vulnerability/PYSEC-2026-1618"},{"source":"nvd","source_id":"CVE-2025-53365","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-53365"}],"summary":"MCP Python SDK has Unhandled Exception in Streamable HTTP Transport, Leading to Denial of Service"}