CVE-2025-53366: MCP SDK Vulnerable to FastMCP Server Validation Error, Leading to Denial of Service
A validation error in the MCP SDK can cause an unhandled exception when processing malformed requests, resulting in service unavailability (500 errors) until manually restarted. Impact may vary depending on the deployment conditions, and presence of infrastructure-level resilience measures.
Thank you to Rich Harang for reporting this issue.
Other sources
The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.9.4, a validation error in the MCP SDK can cause an unhandled exception when processing malformed requests, resulting in service unavailability (500 errors) until manually restarted. Impact may vary depending on the deployment conditions, and presence of infrastructure-level resilience measures. Version 1.9.4 contains a patch for the issue.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-53366?
CVE-2025-53366 is categorized as a high severity vulnerability due to its potential to cause service unavailability.
How do I fix CVE-2025-53366?
To fix CVE-2025-53366, upgrade the MCP SDK to version 1.9.4 or higher.
What type of error does CVE-2025-53366 cause?
CVE-2025-53366 causes an unhandled exception leading to 500 errors when processing malformed requests.
Which software versions are affected by CVE-2025-53366?
CVE-2025-53366 affects all versions of MCP SDK prior to 1.9.4.
Is there any infrastructure resilience against CVE-2025-53366?
The impact of CVE-2025-53366 may vary based on the deployment conditions and the presence of infrastructure-level resilience.