CVE-2025-53366CWE-248

MCP SDK Vulnerable to FastMCP Server Validation Error, Leading to Denial of Service

High · published July 4, 2025

CVSS v4.0
8.7
EPSS
9%
Percentile
95.4
In the wild
Unconfirmed
What it is

The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.9.4, a validation error in the MCP SDK can cause an unhandled exception when processing malformed requests, resulting in service unavailability (500 errors) until manually restarted. Impact may vary depending on the deployment conditions, and presence of infrastructure-level resilience measures. Version 1.9.4 contains a patch for the issue.

The record
Technical detail
CVSS v4.0
8.7 · HIGH
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.09309 · 95.4th percentile
Weakness
CWE-248 · Uncaught Exception
Published
2025-07-04T22:05Z
EPSS history
Timeline
  • 04 JUL 22:05Z
    MCP SDK Vulnerable to FastMCP Server Validation Error, Leading to Denial of Service
    cvelistv5