CVE-2025-53366

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-53366
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-53366.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-53366
Aliases
Downstream
Published
2025-07-04T22:05:02.975Z
Modified
2026-04-10T05:32:04.985289Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
MCP SDK Vulnerable to FastMCP Server Validation Error, Leading to Denial of Service
Details

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.9.4, a validation error in the MCP SDK can cause an unhandled exception when processing malformed requests, resulting in service unavailability (500 errors) until manually restarted. Impact may vary depending on the deployment conditions, and presence of infrastructure-level resilience measures. Version 1.9.4 contains a patch for the issue.

Database specific 
{
    "cwe_ids": [
        "CWE-248"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53366.json",
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/modelcontextprotocol/python-sdk

Affected ranges

Type
GIT
Repo
https://github.com/modelcontextprotocol/python-sdk
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
20dc0fbabb31a33ee52ae6d452445464cca35508

Affected versions

v1.*
v1.0.0
v1.4.0
v1.4.1
v1.5.0
v1.6.0
v1.7.0
v1.8.0
v1.8.1
v1.9.0
v1.9.1
v1.9.2
v1.9.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-53366.json"