go-sdk vulnerabilities

2 known vulnerabilities in go-sdk from Modelcontextprotocol. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.1 High severity

  go-sdk: Initialization of a Resource with an Insecure Default

  CVE-2026-34742Apr 2, 2026Modelcontextprotocol

  The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.0, the Model Context Protocol (MCP) Go SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authenticatio

• 7.5 High severity

  go-sdk: Improper Handling of Case Sensitivity

  CVE-2026-27896Feb 26, 2026Modelcontextprotocol

  The Go MCP SDK used Go's standard encoding/json.Unmarshal for JSON-RPC and MCP protocol message parsing in versions prior to 1.3.1. Go's standard library performs case-insensitive matching of JSON keys to struct field tags — a field tagged json:"method" would