CVE-2026-42559

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-42559
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42559.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-42559
Aliases
Downstream
CGA (8)
Published
2026-05-14T14:24:56Z
Modified
2026-10-28T02:30:24Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H CVSS Calculator
Summary
RMCP: DNS rebinding vulnerability in rmcp Streamable HTTP server transport
Details

RMCP is an official Rust SDK for the Model Context Protocol. Prior to version 1.4.0, the rmcp crate's Streamable HTTP server transport (crates/rmcp/src/transport/streamable_http_server/) did not validate the incoming Host header. This allowed a malicious public website, via a DNS rebinding attack, to send authenticated requests to an MCP server running on the victim's loopback or private-network interface. This vulnerability is fixed in 1.4.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-346",
        "CWE-350"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42559.json"
}
References

Affected packages

Git / github.com/modelcontextprotocol/rust-sdk

Affected ranges

Type
GIT
Repo
https://github.com/modelcontextprotocol/rust-sdk
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4628720f89d27a01d4a126ea9f82f0775df9ed52
Fixed
8e22aa2de28df5a285eed87c11cd89bf15fa90d3
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "1.4.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StringRangeExpression"
        },
        {
            "range": [
                {
                    "fixed": "8e22aa2de28df5a285eed87c11cd89bf15fa90d3"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

rmcp-macros-v0.*
rmcp-macros-v0.10.0
rmcp-macros-v0.11.0
rmcp-macros-v0.12.0
rmcp-macros-v0.13.0
rmcp-macros-v0.14.0
rmcp-macros-v0.15.0
rmcp-macros-v0.16.0
rmcp-macros-v0.17.0
rmcp-macros-v0.2.0
rmcp-macros-v0.2.1
rmcp-macros-v0.3.0
rmcp-macros-v0.3.1
rmcp-macros-v0.3.2
rmcp-macros-v0.4.0
rmcp-macros-v0.4.1
rmcp-macros-v0.5.0
rmcp-macros-v0.6.0
rmcp-macros-v0.6.1
rmcp-macros-v0.6.2
rmcp-macros-v0.6.3
rmcp-macros-v0.7.0
rmcp-macros-v0.8.0
rmcp-macros-v0.8.1
rmcp-macros-v0.8.2
rmcp-macros-v0.8.3
rmcp-macros-v0.8.4
rmcp-macros-v0.8.5
rmcp-macros-v0.9.0
rmcp-macros-v0.9.1
rmcp-macros-v1.*
rmcp-macros-v1.0.0
rmcp-macros-v1.0.0-alpha
rmcp-macros-v1.1.0
rmcp-macros-v1.1.1
rmcp-macros-v1.2.0
rmcp-macros-v1.3.0
rmcp-v0.*
rmcp-v0.10.0
rmcp-v0.11.0
rmcp-v0.12.0
rmcp-v0.13.0
rmcp-v0.14.0
rmcp-v0.15.0
rmcp-v0.16.0
rmcp-v0.17.0
rmcp-v0.2.0
rmcp-v0.2.1
rmcp-v0.3.0
rmcp-v0.3.1
rmcp-v0.3.2
rmcp-v0.4.0
rmcp-v0.4.1
rmcp-v0.5.0
rmcp-v0.6.0
rmcp-v0.6.1
rmcp-v0.6.2
rmcp-v0.6.3
rmcp-v0.7.0
rmcp-v0.8.0
rmcp-v0.8.1
rmcp-v0.8.2
rmcp-v0.8.3
rmcp-v0.8.4
rmcp-v0.8.5
rmcp-v0.9.0
rmcp-v0.9.1
rmcp-v1.*
rmcp-v1.0.0
rmcp-v1.0.0-alpha
rmcp-v1.1.0
rmcp-v1.1.1
rmcp-v1.2.0
rmcp-v1.3.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42559.json"