Vulnerabilities

TI-2026-26986 CVE-2026-34742 · GHSA-xw59-hvm2-8pj6

Model Context Protocol Go SDK: DNS Rebinding Protection Disabled by Default for Servers Running on Localhost

LOW 36

The Go MCP SDK used Go's standard encoding/json.

CVSS 4.0HIGH 7.6 Network No auth User interaction EPSS 0.00472 Published 2026-04-02 Partial fix · 1.4.0 CWE-1188

TI-2026-25670 CVE-2026-33252 · GHSA-89xv-2j6f-qhc8

LOW 30

The Go MCP SDK used Go's standard encoding/json.

CVSS 3.1HIGH 7.1 Network No auth User interaction EPSS 0.00181 Published 2026-03-23 Partial fix · 1.4.1 CWE-352

TI-2026-22240 CVE-2026-27896 · GHSA-wvj2-96wp-fq3f

LOW 37

The Go MCP SDK used Go's standard encoding/json.Unmarshal for JSON-RPC and MCP protocol message parsing in versions prior to 1.3.1.

CVSS 4.0HIGH 7.0 Network No auth No interaction EPSS 0.00292 Published 2026-02-26 Partial fix · 1.3.1 CWE-178