{"data":{"ecosystem":"cargo","name":"rmcp","url":"https://aisecwatch.com/packages/cargo/rmcp","latestVersion":"3.5.1","firstReleaseAt":"2025-03-16T09:50:44.537Z","repository":"https://github.com/modelcontextprotocol/rust-sdk/","llm":{"exposure":"direct","depth":0,"integratedAt":"2025-03-16T09:50:44.537Z","integratedVersion":"0.1.1","sdks":["mcp"],"path":[]},"authority":{"profile":["http"],"fromDependencies":["cargo:reqwest"]},"dependencies":[{"ecosystem":"cargo","name":"async-trait","versionSpec":"^0.1.89","scope":"extra:feature"},{"ecosystem":"cargo","name":"base64","versionSpec":"^0.23","scope":"extra:feature"},{"ecosystem":"cargo","name":"bytes","versionSpec":"^1","scope":"extra:feature"},{"ecosystem":"cargo","name":"chrono","versionSpec":"^0.4.38","scope":"runtime"},{"ecosystem":"cargo","name":"futures","versionSpec":"^0.3","scope":"runtime"},{"ecosystem":"cargo","name":"hmac","versionSpec":"^0.13","scope":"extra:feature"},{"ecosystem":"cargo","name":"http","versionSpec":"^1","scope":"extra:feature"},{"ecosystem":"cargo","name":"http-body","versionSpec":"^1","scope":"extra:feature"},{"ecosystem":"cargo","name":"http-body-util","versionSpec":"^0.1","scope":"extra:feature"},{"ecosystem":"cargo","name":"hyper","versionSpec":"^1","scope":"extra:feature"},{"ecosystem":"cargo","name":"hyper-util","versionSpec":"^0.1","scope":"extra:feature"},{"ecosystem":"cargo","name":"indexmap","versionSpec":"^2","scope":"runtime"},{"ecosystem":"cargo","name":"jsonwebtoken","versionSpec":"^11","scope":"extra:feature"},{"ecosystem":"cargo","name":"oauth2","versionSpec":"^5.0","scope":"extra:feature"},{"ecosystem":"cargo","name":"pastey","versionSpec":"^0.2.0","scope":"extra:feature"},{"ecosystem":"cargo","name":"pin-project-lite","versionSpec":"^0.2","scope":"runtime"},{"ecosystem":"cargo","name":"process-wrap","versionSpec":"^10.0","scope":"extra:feature"},{"ecosystem":"cargo","name":"rand","versionSpec":"^0.10","scope":"extra:feature"},{"ecosystem":"cargo","name":"reqwest","versionSpec":"^0.13.2","scope":"extra:feature"},{"ecosystem":"cargo","name":"rmcp-macros","versionSpec":"^3.5.1","scope":"extra:feature"},{"ecosystem":"cargo","name":"schemars","versionSpec":"^1.0","scope":"extra:feature"},{"ecosystem":"cargo","name":"serde","versionSpec":"^1.0","scope":"runtime"},{"ecosystem":"cargo","name":"serde-json","versionSpec":"^1.0","scope":"runtime"},{"ecosystem":"cargo","name":"sha2","versionSpec":"^0.11","scope":"extra:feature"},{"ecosystem":"cargo","name":"sse-stream","versionSpec":"^0.2.4","scope":"extra:feature"},{"ecosystem":"cargo","name":"thiserror","versionSpec":"^2","scope":"runtime"},{"ecosystem":"cargo","name":"tokio","versionSpec":"^1","scope":"runtime"},{"ecosystem":"cargo","name":"tokio-stream","versionSpec":"^0.1","scope":"extra:feature"},{"ecosystem":"cargo","name":"tokio-util","versionSpec":"^0.7","scope":"runtime"},{"ecosystem":"cargo","name":"tower-service","versionSpec":"^0.3","scope":"extra:feature"},{"ecosystem":"cargo","name":"tracing","versionSpec":"^0.1","scope":"runtime"},{"ecosystem":"cargo","name":"url","versionSpec":"^2.4","scope":"extra:feature"},{"ecosystem":"cargo","name":"uuid","versionSpec":"^1","scope":"extra:feature"},{"ecosystem":"cargo","name":"which","versionSpec":"^8","scope":"extra:feature"},{"ecosystem":"cargo","name":"zeroize","versionSpec":"^1","scope":"extra:feature"}],"advisories":[{"id":"99fc6cfa-bcd9-4bdd-b5a3-5202f17546b1","url":"https://aisecwatch.com/issues/99fc6cfa-bcd9-4bdd-b5a3-5202f17546b1","cveId":null,"title":"GHSA-c9xm-49cp-xcr9: rmcp OAuth client fetches server-controlled resource_metadata URLs","severity":"medium","publishedAt":"2026-10-02T16:12:31.000Z","affected":["rmcp@< 2.0.0 (fixed: 2.0.0)"],"epssScore":null},{"id":"036c0023-2eb9-4366-8f0e-421ac8a79b43","url":"https://aisecwatch.com/issues/036c0023-2eb9-4366-8f0e-421ac8a79b43","cveId":"CVE-2026-64684","title":"GHSA-9g45-5xwm-f3wc: RMCP: Custom HTTP headers leak to cross-origin redirect targets","severity":"medium","publishedAt":"2026-09-17T14:48:12.000Z","affected":["rmcp@< 2.1.0 (fixed: 2.1.0)"],"epssScore":0.005},{"id":"3e4e55cc-60f0-4af6-ac55-5929ba3ce17f","url":"https://aisecwatch.com/issues/3e4e55cc-60f0-4af6-ac55-5929ba3ce17f","cveId":"CVE-2026-63128","title":"GHSA-9pj6-vhgr-3mwh: RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service","severity":"high","publishedAt":"2026-09-16T22:13:34.000Z","affected":["rmcp@< 2.0.0 (fixed: 2.0.0)"],"epssScore":0.0063},{"id":"8ed6e188-9f8f-4757-8b48-b418fd972f83","url":"https://aisecwatch.com/issues/8ed6e188-9f8f-4757-8b48-b418fd972f83","cveId":"CVE-2026-63127","title":"GHSA-33f5-2c5q-wgwj: RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery","severity":"high","publishedAt":"2026-09-16T22:13:26.000Z","affected":["rmcp@< 2.0.0 (fixed: 2.0.0)"],"epssScore":0.00203},{"id":"0102714c-ca59-49e9-b7a8-3b48686911fb","url":"https://aisecwatch.com/issues/0102714c-ca59-49e9-b7a8-3b48686911fb","cveId":"CVE-2026-42559","title":"GHSA-89vp-x53w-74fx: rmcp Streamable HTTP server transport has a DNS rebinding vulnerability","severity":"high","publishedAt":"2026-05-06T21:55:56.000Z","affected":["rmcp@< 1.4.0 (fixed: 1.4.0)"],"epssScore":0.00242}],"checkedAt":"2026-10-10T00:49:51.618Z"},"meta":{"advisoryMatching":"by package name; advisory records do not state an ecosystem"}}