CVE-2025-53366highDenial of service2025-07-04
CVE-2025-53366: MCP Python SDK vulnerability in the FastMCP Server causes validation error, leading to DoS
A validation error in the MCP SDK can cause an unhandled exception when processing malformed requests, resulting in service unavailability (500 errors) until manually restarted. Impact may vary depending on the deployment conditions, and presence of infrastructure-level resilience measures.
What it is
A validation error in the MCP SDK can cause an unhandled exception when processing malformed requests, resulting in service unavailability (500 errors) until manually restarted. Impact may vary depending on the deployment conditions, and presence of infrastructure-level resilience measures.
How to check
- Affected: mcp (pip) < 1.9.4.
- Compare your installed version with the range above (command below).
How to fix
- Upgrade mcp to 1.9.4 or later.
pip show mcp | grep VersionSources
More advisories for this tool
- criticalCVE-2026-96620: Claude Agent SDK (Python) resume option lets attackers run commands
- criticalCVE-2026-95182: DeepSeek Harness can be tricked into running a planted fake npx
- criticalLangflow: adding an MCP server runs any command on the host (CVE-2026-105697, CVE-2026-105740)
- criticalCVE-2026-32871: FastMCP OpenAPI Provider has an SSRF & Path Traversal Vulnerability