MediumVulnerability

GHSA-84m7-p3x7-pcfv: MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion

Source: GitHub Advisory(opens in a new tab)
Identifiers: CVE-2026-59951GHSA-84m7-p3x7-pcfv
Published: October 15, 2026
Record updated: October 15, 2026

Affected: mcp >= 2.0.0, < 2.2.0, fixed in 2.2.0
mcp >= 1.8.0, < 1.30.0, fixed in 1.30.0
Known exploitation: Not listed in the CISA Known Exploited Vulnerabilities catalog at the last check.
EPSS: 0.5%

Summary

The MCP Python SDK's Streamable HTTP transport in stateful mode, the default, never reclaimed session state in affected versions 1.8.0 through 1.29.1 and 2.0.0 through 2.1.1. Sessions did not expire, DELETE left entries registered, and refused sessions kept running tasks, so any client that could reach the endpoint could grow server memory without bound until a restart.

Mitigation

Upgrade to mcp 1.30.0 (1.x) or 2.2.0 (2.x) or later, which add session_idle_timeout (default 1800 seconds) and max_sessions (default 10000) and discard sessions as soon as they end. If you cannot upgrade yet, pass stateless_http=True (1.12.0 or later) where no per-session state is needed, or restrict who can reach the endpoint.

Details

Scores and exploitation

Patch available: Yes
EPSS: 0.5%Estimated probability that this CVE is exploited in the next 30 days, from the FIRST Exploit Prediction Scoring System. Read on October 15, 2026.
Disclosure date: October 15, 2026

Affected

Packages: mcp@>= 2.0.0, < 2.2.0 (fixed: 2.2.0)
mcp@>= 1.8.0, < 1.30.0 (fixed: 1.30.0)
Vendors: Anthropic

Classification

Attack type: Denial of service
Attack sophistication: Trivial
AI component targeted: API
Impact: Availability
Labels: security

How this record was produced

Summaries, mitigations and labels on this page are generated automatically from the source. The linked source is authoritative.

Original source: https://github.com/advisories/GHSA-84m7-p3x7-pcfv

First tracked: October 15, 2026 at 08:01 PM ET, from GitHub Advisory Database

Classifier: claude-haiku-5-5, prompt v4

Classifier confidence: 85% (self-assessed)

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

mcpPyPILLM dependency since 2024-11-20 · 61 tracked dependents

Topics

Model Context Protocol

Summary

Mitigation

Affected packages in the Exposure Registry

Topics

Related items