modelcontextprotocol rust-sdk vulnerabilities

Latest modelcontextprotocol rust-sdk CVEs

Newest publication first

1. CVE-2026-64684 RMCP: Custom HTTP headers leak to cross-origin redirect targets

   Published 2026-09-16

   Medium·CVSS 6.8

   RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.1.0, the rmcp crate's StreamableHttpClientTransport in crates/rmcp/src/transport/common/reqwest/streamable_http_client.rs builds its default_http_client with reqwest's automatic redirect policy and applies ca...

2. CVE-2026-63127 RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery

   Published 2026-09-16

   High·CVSS 8.2

   RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's OAuth implementation in crates/rmcp/src/transport/auth.rs omits the RFC 9728 resource field from ResourceServerMetadata and allows discover_oauth_server_via_resource_metadata to use prot...

3. CVE-2026-63128 RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service

   Published 2026-09-16

   High·CVSS 7.5

   RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's stateful Streamable HTTP server in crates/rmcp/src/transport/streamable_http_server/tower.rs allows an unauthenticated client to send a well-formed JSON-RPC POST that is not an initializ...

4. CVE-2026-42559 RMCP: DNS rebinding vulnerability in rmcp Streamable HTTP server transport

   Published 2026-05-14

   High·CVSS 8.8

   RMCP is an official Rust SDK for the Model Context Protocol. Prior to version 1.4.0, the rmcp crate's Streamable HTTP server transport (crates/rmcp/src/transport/streamable_http_server/) did not validate the incoming Host header. This allowed a malicious public website, via a DNS...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.