rust-sdk vulnerabilities

3 known vulnerabilities in rust-sdk from Modelcontextprotocol. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  rust-sdk: Uncontrolled Resource Consumption

  CVE-2026-63128Sep 16, 2026Modelcontextprotocol

  RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's stateful Streamable HTTP server in crates/rmcp/src/transport/streamable_http_server/tower.rs allows an unauthenticated client to send a well-formed JSON-RPC POST that

• 8.2 High severity

  rust-sdk: Insufficient Verification of Data Authenticity

  CVE-2026-63127Sep 16, 2026Modelcontextprotocol

  RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's OAuth implementation in crates/rmcp/src/transport/auth.rs omits the RFC 9728 resource field from ResourceServerMetadata and allows discover_oauth_server_via_resource_

• 8.8 High severity

  rust-sdk: Origin Validation Error

  CVE-2026-42559May 14, 2026Modelcontextprotocol

  RMCP is an official Rust SDK for the Model Context Protocol. Prior to version 1.4.0, the rmcp crate's Streamable HTTP server transport (crates/rmcp/src/transport/streamable_http_server/) did not validate the incoming Host header. This allowed a malicious publi