GHSA-3qhf-m339-9g5v

MCP Python SDK vulnerability in the FastMCP Server causes validation error, leading to DoS

Source: GitHub Advisory Database (reviewed) High CVE-2025-53366

Packages

Ecosystem	Package	Affected	Fixed in
PyPI	mcp	< 1.9.4	1.9.4

Details

As written in the advisory (Markdown source, shown as plain text).

A validation error in the MCP SDK can cause an unhandled exception when processing malformed requests, resulting in service unavailability (500 errors) until manually restarted. Impact may vary depending on the deployment conditions, and presence of infrastructure-level resilience measures. Thank you to Rich Harang for reporting this issue.

References

External links from the advisory. They lead to third-party sites.

https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-3qhf-m339-9g5v web
https://nvd.nist.gov/vuln/detail/CVE-2025-53366 advisory
https://github.com/modelcontextprotocol/python-sdk/pull/822 web
https://github.com/modelcontextprotocol/python-sdk/commit/29c69e6a47d0104d0afcea6ac35e7ab02fde809a web
https://github.com/advisories/GHSA-3qhf-m339-9g5v advisory
https://github.com/modelcontextprotocol/python-sdk package
https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.9.4 web
https://github.com/pypa/advisory-database/tree/main/vulns/mcp/PYSEC-2026-1616.yaml web
https://pypi.org/project/mcp web