Rust Sdk
Monthly
OAuth access-token theft in the rmcp Rust SDK (the official Rust SDK for the Model Context Protocol) before 2.0.0 allows a malicious MCP server to harvest a victim's legitimate bearer token by publishing RFC 9728 protected-resource metadata that names a different, legitimate MCP resource together with that resource's authorization server. The OAuth client transport never verifies that the returned `resource` identifier matches the MCP server URL it was actually configured to contact, so a victim who connects and completes the normal authorization/consent flow receives a genuine access token and then sends it to the attacker's endpoint, letting the attacker replay it against the legitimate MCP resource within the granted scopes. Exploitation requires the user to be induced to connect to the attacker-controlled server and to complete consent (UI:R; CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N, SSVC Automatable=no), publicly available exploit code exists per the SSVC exploitation signal, and there is no CISA KEV entry confirming active exploitation.
Unbounded memory growth in the stateful Streamable HTTP transport of the rmcp Rust SDK (crates/rmcp, all versions prior to 2.0.0) lets remote, unauthenticated attackers permanently leak session state and eventually crash the server. A crafted JSON-RPC POST that is either not an initialization request, or an initialization request whose MCP-Protocol-Version header disagrees with its body, causes StreamableHttpService::handle_post to call LocalSessionManager.create_session before the message is validated; when validation then fails, the handler returns without removing the inserted LocalSessionHandle, so each request leaves a permanent entry in the shared session table. Because exploitation requires sustained repetition to exhaust memory and degrade legitimate clients through lock contention, CISA SSVC rates it PoC-exploitable but not automatable, while publicly available exploit code exists and CVSS 3.1 scores it 7.5 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), with availability as the only impacted security property.
OAuth access-token theft in the rmcp Rust SDK (the official Rust SDK for the Model Context Protocol) before 2.0.0 allows a malicious MCP server to harvest a victim's legitimate bearer token by publishing RFC 9728 protected-resource metadata that names a different, legitimate MCP resource together with that resource's authorization server. The OAuth client transport never verifies that the returned `resource` identifier matches the MCP server URL it was actually configured to contact, so a victim who connects and completes the normal authorization/consent flow receives a genuine access token and then sends it to the attacker's endpoint, letting the attacker replay it against the legitimate MCP resource within the granted scopes. Exploitation requires the user to be induced to connect to the attacker-controlled server and to complete consent (UI:R; CVSS 3.1 vector AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N, SSVC Automatable=no), publicly available exploit code exists per the SSVC exploitation signal, and there is no CISA KEV entry confirming active exploitation.
Unbounded memory growth in the stateful Streamable HTTP transport of the rmcp Rust SDK (crates/rmcp, all versions prior to 2.0.0) lets remote, unauthenticated attackers permanently leak session state and eventually crash the server. A crafted JSON-RPC POST that is either not an initialization request, or an initialization request whose MCP-Protocol-Version header disagrees with its body, causes StreamableHttpService::handle_post to call LocalSessionManager.create_session before the message is validated; when validation then fails, the handler returns without removing the inserted LocalSessionHandle, so each request leaves a permanent entry in the shared session table. Because exploitation requires sustained repetition to exhaust memory and degrade legitimate clients through lock contention, CISA SSVC rates it PoC-exploitable but not automatable, while publicly available exploit code exists and CVSS 3.1 scores it 7.5 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), with availability as the only impacted security property.