EUVD-2026-80823Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated single-POST trigger against a network endpoint gives AV:N/AC:L/PR:N/UI:N; availability-only resource exhaustion yields A:H with C:N/I:N and no scope change.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
3DescriptionCVE.org
RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's stateful Streamable HTTP server in crates/rmcp/src/transport/streamable_http_server/tower.rs allows an unauthenticated client to send a well-formed JSON-RPC POST that is not an initialization request, or an initialization request with a mismatched protocol header, causing StreamableHttpService::handle_post to call LocalSessionManager.create_session before validating the message. An early validation failure returns without removing the inserted LocalSessionHandle from LocalSessionManager.sessions, permanently retaining session and channel state for the server process lifetime. Repeated requests can grow the shared session table without bound, degrade legitimate-client latency through lock contention, exhaust memory, and terminate the server. This issue is fixed in version 2.0.0.
AnalysisAI
Unbounded memory growth in the stateful Streamable HTTP transport of the rmcp Rust SDK (crates/rmcp, all versions prior to 2.0.0) lets remote, unauthenticated attackers permanently leak session state and eventually crash the server. A crafted JSON-RPC POST that is either not an initialization request, or an initialization request whose MCP-Protocol-Version header disagrees with its body, causes StreamableHttpService::handle_post to call LocalSessionManager.create_session before the message is validated; when validation then fails, the handler returns without removing the inserted LocalSessionHandle, so each request leaves a permanent entry in the shared session table. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the server to run the rmcp crate's STATEFUL Streamable HTTP transport (StreamableHttpService with LocalSessionManager) on a network-reachable interface, in rust-sdk versions prior to 2.0.0. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H = 7.5 HIGH) is internally consistent with the description and credible: a remote, unauthenticated client can trigger the flaw with a single well-formed JSON-RPC POST, and impact is availability-only (no confidentiality or integrity loss), which matches CWE-400 (Uncontrolled Resource Consumption). … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Vendor-released patch: rmcp 2.0.0 - upgrade the crate dependency to 2.0.0 or later (crate release rmcp-v2.0.0, https://github.com/modelcontextprotocol/rust-sdk/releases/tag/rmcp-v2.0.0), or cherry-pick the upstream fix from commit dfa7fd6f9309deab60bea230b041be9a3fcda846 / PR https://github.com/modelcontextprotocol/rust-sdk/pull/934, which moves session creation after the message-shape and MCP-Protocol-Version header/body validation so rejected requests no longer insert session handles. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every application and build dependency that pulls in crates/rmcp, identify which deployments run a version prior to 2.0.0, and begin upgrading the most exposed internet-facing or production MCP endpoints to rmcp 2.0.0 or later; where an immediate upgrade is not feasible, apply edge rate limiting and session-table size limits on the JSON-RPC POST path as a temporary brake. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-400 – Uncontrolled Resource Consumption
View allSame technique Denial Of Service
View allShare
External POC / Exploit Code
Leaving vuln.today