modelcontextprotocol/rust-sdk Security Advisories | GitStock

medium2026-10-02

rmcp OAuth client fetches server-controlled resource_metadata URLs

GHSA-c9xm-49cp-xcr9

medium2026-09-17

RMCP: Custom HTTP headers leak to cross-origin redirect targets

GHSA-9g45-5xwm-f3wc · CVE-2026-64684

high2026-09-16

RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service

GHSA-9pj6-vhgr-3mwh · CVE-2026-63128

high2026-09-16

RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery

GHSA-33f5-2c5q-wgwj · CVE-2026-63127

high2026-05-06

rmcp Streamable HTTP server transport has a DNS rebinding vulnerability

GHSA-89vp-x53w-74fx · CVE-2026-42559