Security: modelcontextprotocol/go-sdk
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
DNS Rebinding Protection Disabled by Default in Model Context Protocol Go SDK for Servers Running on LocalhostGHSA-xw59-hvm2-8pj6 published
Mar 30, 2026 by maciej-kisielHigh -
Cross-Site Tool Execution for HTTP Servers without Authorization in github.com/modelcontextprotocol/go-sdkGHSA-89xv-2j6f-qhc8 published
Mar 18, 2026 by maciej-kisielHigh -
Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdkGHSA-q382-vc8q-7jhj published
Mar 18, 2026 by maciej-kisielHigh -
Improper Handling of Case Sensitivity in github.com/modelcontextprotocol/go-sdkGHSA-wvj2-96wp-fq3f published
Feb 25, 2026 by jenn-newtonHigh