MCP Python SDK EUVD-2026-101452

Exploitable ONLY against stateful Streamable HTTP servers - specifically FastMCP, MCPServer, Server.streamable_http_app(), and StreamableHTTPSessionManager - running mcp (PyPI) from 1.8.0 up to (but not including) 1.30.0, and version 2.2.0. The server must retain sessions (the default stateful mode); deployments using stateless_http=True, stdio, or SSE transports are NOT affected. No attacker privilege, user interaction, or authentication is required (PR:N/UI:N). Limiting factors: impact is per-process memory only, self-recovers on restart, and is bounded on fixed versions by the new session_idle_timeout (30 min default) and max_sessions (10,000 default) controls; the vulnerable window is the specific affected version range combined with the stateful transport configuration.

All impact signals point to a single, bounded outcome: availability loss. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L, score 6.9) is internally consistent with CWE-400 (uncontrolled resource consumption) and with the description - a remote, unauthenticated client (PR:N) issuing ordinary short requests over the network (AV:N) with low complexity (AC:L) can grow server memory without bound. There is NO confidentiality or integrity impact (VC:N/VI:N), and availability impact is rated Low (VA:L) rather than High, reflecting gradual memory-growth-until-restart rather than an instant crash. No EPSS score, CISA KEV listing, POC flag, or SSVC decision data was provided in the input, so exploitation probability and real-world activity cannot be quantified - absence of these signals is not evidence of safety, but should not be read as active exploitation either. This is a genuine but mid-tier priority: trivially reachable and unauthenticated, yet self-limiting (recovers on restart) and confined to one process's memory, so it is a reliability/abuse concern rather than a code-execution or data-breach emergency. The main escalating factor is that MCP servers are increasingly internet- or agent-facing, making the unauthenticated network vector realistic to trigger.

An attacker who can reach a stateful Streamable HTTP MCP endpoint (e.g. a FastMCP or MCPServer instance exposed to a network) repeatedly opens short sessions or sends refused/incomplete initialize requests, none of which reliably release their session entries. Because entries also retain parsed initialize parameters and have no idle expiration or aggregate count cap, the attacker drives unbounded memory growth until the process is exhausted and must be restarted. No public exploit identified at time of analysis, but the technique requires only ordinary, well-formed requests.