{"cve":"CVE-2025-53366","nvd":{"published":"2025-07-04T22:15:22.300","modified":"2026-06-17T09:38:06.047","status":"Deferred","description":"The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.9.4, a validation error in the MCP SDK can cause an unhandled exception when processing malformed requests, resulting in service unavailability (500 errors) until manually restarted. Impact may vary depending on the deployment conditions, and presence of infrastructure-level resilience measures. Version 1.9.4 contains a patch for the issue.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":8.7},"cvss_v3":null,"cwes":["CWE-248"],"references":["https://github.com/modelcontextprotocol/python-sdk/commit/29c69e6a47d0104d0afcea6ac35e7ab02fde809a","https://github.com/modelcontextprotocol/python-sdk/pull/822","https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-3qhf-m339-9g5v"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:04:28.436527499+00:00"},"epss":{"cve":"CVE-2025-53366","score":0.09754,"percentile":0.95526,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-3qhf-m339-9g5v","url":"https://osv.dev/vulnerability/GHSA-3qhf-m339-9g5v","summary":"MCP Python SDK vulnerability in the FastMCP Server causes validation error, leading to DoS","modified":"2026-07-16T18:45:48.199122861Z","packages":[{"ecosystem":"PyPI","name":"mcp","purl":"pkg:pypi/mcp","ranges":["<1.9.4"],"fixed":["1.9.4"]}]},{"id":"PYSEC-2026-1616","url":"https://osv.dev/vulnerability/PYSEC-2026-1616","summary":"MCP Python SDK vulnerability in the FastMCP Server causes validation error, leading to DoS","modified":"2026-07-07T17:47:03.420621263Z","packages":[{"ecosystem":"PyPI","name":"mcp","purl":"pkg:pypi/mcp","ranges":["<1.9.4"],"fixed":["1.9.4"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}