Description
The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.8.0 until 1.30.0 and 2.2.0, stateful Streamable HTTP servers, including FastMCP, MCPServer, Server.streamable_http_app(), and StreamableHTTPSessionManager, retain session entries without an idle expiration or aggregate session-count limit. DELETE, refused opening requests, and completed sessions do not reliably discard their entries, and each entry can retain parsed initialize parameters. A client that can reach the endpoint can therefore create ordinary short requests that grow server memory without bound until restart. Stateless HTTP, stdio, and SSE transports are not affected. This issue is fixed in versions 1.30.0 and 2.2.0.
Published: 2026-10-14
Score: 6.9 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via resource exhaustion
Action: Patch
AI Analysis

Impact

The MCP Python SDK (mcp on PyPI) contains a flaw in its stateful Streamable HTTP servers, such as FastMCP and MCPServer, where session entries are not expired or limited once they are created. Each session retains parsed initialization parameters and lives indefinitely unless it is the result of a DELETE, refused opening request, or a completed session that does not reliably discard its entry. The bug allows a client that can reach the endpoint to submit short requests that continually add new session entries, causing the server’s memory consumption to grow without bound. This uncontrolled memory growth can eventually exhaust system resources and crash the service, leading to a denial of service.

Affected Systems

The vulnerability affects the MCP Python SDK package named mcp released via PyPI. Vulnerable releases include versions 1.8.0 through 1.29.x and 2.0.0 through 2.1.x. The fix was incorporated in release 1.30.0 and 2.2.0. The issue only applies to stateful Streamable HTTP servers; stateless HTTP, stdio, and SSE transports are unaffected.

Risk and Exploitability

The CVSS score of 6.9 indicates moderate severity. Because there is an EPSS score of <1% and the vulnerability is not listed in the CISA KEV catalog, the current public exploitation probability is low but not zero. The attack vector is any client with network access to the affected endpoint, and the impact scales with the number of session creations. The flaw is a classic case of uncontrolled resource consumption (CWE-400) and lack of resource cleanup (CWE-772).

Generated by OpenCVE AI on October 15, 2026 at 18:05 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the MCP Python SDK to version 1.30.0 or later, including 2.2.0.
  • Disabling stateful Streamable HTTP servers or switching to stateless HTTP, stdio, or SSE transports as a temporary mitigation if an upgrade cannot be performed immediately.
  • Enable rate limiting on the Streamable HTTP endpoints to restrict the frequency of session creations per client.
  • Monitor the application’s memory usage and set alerts to detect abnormal growth that may indicate exploitation attempts.

Generated by OpenCVE AI on October 15, 2026 at 18:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-84m7-p3x7-pcfv MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion
History

Sat, 17 Oct 2026 18:15:00 +0000

Type Values Removed Values Added
First Time appeared Modelcontextprotocol
Modelcontextprotocol python-sdk
Vendors & Products Modelcontextprotocol
Modelcontextprotocol python-sdk

Fri, 16 Oct 2026 00:30:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Important

Thu, 15 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Wed, 14 Oct 2026 16:30:00 +0000

Type Values Removed Values Added
Description The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.8.0 until 1.30.0 and 2.2.0, stateful Streamable HTTP servers, including FastMCP, MCPServer, Server.streamable_http_app(), and StreamableHTTPSessionManager, retain session entries without an idle expiration or aggregate session-count limit. DELETE, refused opening requests, and completed sessions do not reliably discard their entries, and each entry can retain parsed initialize parameters. A client that can reach the endpoint can therefore create ordinary short requests that grow server memory without bound until restart. Stateless HTTP, stdio, and SSE transports are not affected. This issue is fixed in versions 1.30.0 and 2.2.0.
Title MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion
Weaknesses CWE-400
CWE-772
References
Metrics cvssV4_0

{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N'}

Subscriptions

Modelcontextprotocol Python-sdk
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-10-15T15:07:43.737Z

Reserved: 2026-07-07T18:49:15.607Z

Link: CVE-2026-59951

cve-icon Vulnrichment

Updated: 2026-10-15T13:55:54.963Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-14T17:18:29.690

Modified: 2026-10-16T16:00:33.533

Link: CVE-2026-59951

cve-icon Redhat

Severity : Important

Publid Date: 2026-10-14T16:22:31Z

Links: CVE-2026-59951 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T18:00:10Z

Weaknesses
  • CWE-400

    Uncontrolled Resource Consumption

  • CWE-772

    Missing Release of Resource after Effective Lifetime