GHSA-q382-vc8q-7jhj: Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk

Summary

The Go SDK for the Model Context Protocol moved to the segmentio/encoding library for JSON parsing in version 1.3.1. The new parser matched keys that had null Unicode characters appended to their base names, so combined with duplicate keys, a "last key wins" resolution could override the intended MCP message. This could let messages evade proxies or policy layers that match exact field names, and other MCP SDKs in TypeScript and Python would reject the same messages.

Mitigation

The segmentio/encoding package was patched and released as v0.5.4, and the SDK switched to the patched dependency in 724dd47aa. Users are advised to update to v1.4.1.

Affected packages in the Exposure Registry

Matched by package name and ecosystem. Each entry shows whether the package delegates to a language model and how many tracked packages depend on it.

• github.com/modelcontextprotocol/go-sdkGoLLM dependency since 2025-07-01 · 1 tracked dependent

Topics

• Model Context Protocol

Related items

• LowAnthropic Cuts Live Internet Access for Internal AI Tests After Claude Exploits Injection FlawsSimilar attack · The Hacker News
• CriticalCVE-2026-108263: Astron Agent code-node execution as root through workflow run endpointsSimilar attack · NVD/CVE Database
• MediumHackers abuse Google Ads, Bing redirects to push Claude ClickFix attacksSimilar attack · BleepingComputer
• CriticalHermes Agent - PKCE Session Takeover via Redirect-URI Parser ConfusionSimilar attack · Tenable Research Advisories
• LowSocial Engineering AI Agents: The New BEC for 2026Similar attack · Dark Reading