Skip to content
OpenAdvisories

Product · modelcontextprotocol

rust-sdk

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.2
    CVE-2026-63127

    RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery

    RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's OAuth implementation in crates/rmcp/src/transport/auth.rs omits the RFC 9728 resource field from ResourceServerMetadata and allows discover_oauth_server_via_resource…

    modelcontextprotocol rust-sdk rmcp crates.io
  • High 7.5
    CVE-2026-63128

    RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service

    RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's stateful Streamable HTTP server in crates/rmcp/src/transport/streamable_http_server/tower.rs allows an unauthenticated client to send a well-formed JSON-RPC POST tha…

    modelcontextprotocol rust-sdk rmcp crates.io
  • High 8.8
    CVE-2026-42559 Public exploit

    RMCP: DNS rebinding vulnerability in rmcp Streamable HTTP server transport

    RMCP is an official Rust SDK for the Model Context Protocol. Prior to version 1.4.0, the rmcp crate's Streamable HTTP server transport (crates/rmcp/src/transport/streamable_http_server/) did not validate the incoming Host header. This allowed a malicious publ…

    modelcontextprotocol rust-sdk rmcp dynoxide-rs npm crates.io