CVE-2026-59951 modelcontextprotocol CVE debrief

Who should care

Defenders managing MCP Python SDK servers, especially those using Streamable HTTP in stateful mode with untrusted clients, should assess exposure and prioritize remediation. This includes reviewing current server configurations, verifying client trust levels, and monitoring server memory usage. Additionally, defenders should consider the potential impact on specific deployments and perform vulnerability assessments to identify potentially exposed assets. A

Why it matters

CVE-2026-59951 allows for resource exhaustion in MCP Python SDK servers using StreamableHTTP in stateful mode. Defenders should assess exposure, especially if untrusted clients can reach the endpoint, and prioritize upgrading to fixed versions.

• Resource exhaustion through memory growth without bound.
• Potential for denial of service due to server restart requirement.
• Need for verification of current server configurations and client trust levels.
• Priority for upgrading to fixed versions to prevent exploitation.

Technical summary

The MCP Python SDK is vulnerable to unbounded session accumulation in StreamableHTTP transport, allowing for resource exhaustion. This occurs in stateful mode (default) where sessions do not expire and accumulate without limit. Affected versions are 1.8.0 through 1.29.1 and 2.0.0 through 2.1.1. The issue arises when a Streamable HTTP server operates in stateful mode, which is the default setting. This mode does not reclaim session state, leading to unlimited session accumulation. Clients that can reach the endpoint can cause server memory growth without bound using short requests. The only recovery is a server restart. To address this vulnerability, defenders should prioritize upgrading to mcp 1.30.0 (for 1.x)

Defensive priority

Defenders should prioritize upgrading to mcp 1.30.0 (for 1.x) or 2.2.0 (for 2.x) or later. Immediate action is required for servers running in stateful mode with untrusted clients.

Recommended defensive actions

• Upgrade to mcp 1.30.0 (for 1.x) or 2.2.0 (for 2.x) or later.
• Review and adjust server configurations to ensure stateful mode is not used with untrusted clients.
• Monitor server memory usage and implement compensating controls to mitigate potential resource exhaustion.
• Perform vulnerability assessment to identify potentially exposed assets.
• Review relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The vulnerability details are based on the provided source corpus from osv_dev, which includes information from the MCP Python SDK GitHub repository and the CVE Program record. The source item provides details on the vulnerability, and defenders should verify the current server configurations and client trust levels. The CVE Program record and NVD detail page offer additional context. However, the exact scope of affected systems and potential impact on specific deployments remains limited by the information available in the source. To

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.