These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-64684 is a vulnerability in the Rust SDK for the Model Context Protocol (RMCP). The issue arises from the StreamableHttpClientTransport in the rmcp crate, which uses reqwest's automatic redirect policy and applies custom headers without marking them as sensitive. This can lead to the replay of custom API keys or authentication tokens to a new origin when a malicious or compromised MCP endpoint re [truncated]
CVE-2026-53937 is a remote-pre-auth denial of service vulnerability in MCP Kotlin SDK versions 0.7.0 through 0.12.0. The issue arises from the `ReadBuffer.append` function in `ReadBuffer.kt`, which writes received bytes into a buffer without a size cap, leading to potential OOM-killing of the JVM or host process. This vulnerability is triggered when an untrusted or attacker-controlled producer feeds bytes [truncated]
The MCP PHP SDK, used for the Model Context Protocol, has a vulnerability in versions 0.5.0 through 0.7.0 that allows a remote server to cause a denial of service by exhausting the client's memory. This issue arises from the HTTP client transport reading Server-Sent Events response streams without a proper buffer limit, leading to potential fatal allocation errors or OS out-of-memory kills. The vulnerabil [truncated]
The MCP Python SDK, called mcp on PyPI, has a vulnerability prior to version 1.28.1 in the deprecated mcp.server.websocket.websocket_server transport. This transport accepted WebSocket handshakes without applying Host or Origin header validation, potentially allowing unauthorized connections. The issue is fixed in version 1.28.1. Affected users, especially those who have exposed the deprecated transport, [truncated]
The MCP Python SDK, called mcp on PyPI, has a high-severity vulnerability tracked as CVE-2026-52870. From version 1.23.0 until 1.27.2, default handlers installed by server.experimental.enable_tasks() for tasks/list, tasks/get, tasks/result, and tasks/cancel operate only on task identifiers without recording the session that created each task. This allows any connected client to enumerate, read results fro [truncated]
The MCP Python SDK, called mcp on PyPI, is vulnerable to session hijacking prior to version 1.27.2. The SSE and stateful Streamable HTTP transports route requests to existing sessions using only the session_id query parameter or Mcp-Session-Id header without verifying the authenticated principal that created the session. This allows a different bearer-token-authenticated client with a known session ID to [truncated]
The CVE-2026-35568 vulnerability is a DNS rebinding issue in the MCP Java SDK prior to version 1.0.0. This vulnerability allows an attacker to access a locally or network-private MCP server via a victim's browser that is either local or network adjacent. Consequently, the attacker can make any tool calls to the server as if they were a locally running MCP connected AI agent. The vulnerability is fixed in [truncated]
The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.0, the Model Context Protocol (MCP) Go SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication with StreamableHTTPHandler or SSEHandler, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send reque [truncated]
CVE-2026-25536 is a HIGH severity vulnerability in the MCP TypeScript SDK, affecting versions 1.10.0 to 1.25.3. The issue allows for cross-client response data leaks when a single McpServer/Server and transport instance is reused across multiple client connections. This is particularly problematic in stateless StreamableHTTPServerTransport deployments. The vulnerability has been patched in version 1.26.0. [truncated]
