{"data":{"id":"f6ea76b5-fcbe-4c55-a8b3-a30a6d2bdcc9","title":"GHSA-q382-vc8q-7jhj: Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk","summary":"The Go SDK for the Model Context Protocol moved to the segmentio/encoding library for JSON parsing in version 1.3.1. The new parser matched keys that had null Unicode characters appended to their base names, so combined with duplicate keys, a \"last key wins\" resolution could override the intended MCP message. This could let messages evade proxies or policy layers that match exact field names, and other MCP SDKs in TypeScript and Python would reject the same messages.","solution":"The segmentio/encoding package was patched and released as v0.5.4, and the SDK switched to the patched dependency in 724dd47aa. Users are advised to update to v1.4.1.","labels":["security"],"sourceUrl":"https://github.com/advisories/GHSA-q382-vc8q-7jhj","publishedAt":"2026-03-19T12:44:07.000Z","cveId":null,"cweIds":["CWE-436","CWE-1395"],"cvssScore":null,"cvssSeverity":"high","severity":"high","attackType":["other"],"issueType":"vulnerability","affectedPackages":["github.com/modelcontextprotocol/go-sdk@<= 1.4.0 (fixed: 1.4.1)"],"affectedPackageNames":["github.com/modelcontextprotocol/go-sdk"],"affectedPackageRefs":["go:github.com/modelcontextprotocol/go-sdk"],"affectedVendors":[],"affectedVendorsRaw":["Model Context Protocol Go SDK"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":["GHSA-q382-vc8q-7jhj"],"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":true,"disclosureDate":"2026-03-19T12:44:07.000Z","capecIds":null,"crossRefCount":0,"attackSophistication":"moderate","impactType":["integrity","confidentiality"],"aiComponentTargeted":"api","llmSpecific":false,"classifierConfidence":0.9,"researchCategory":null,"atlasIds":null}}