CVE-2026-59951: MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables Resource Exhaustion

Q: Which deployments are exposed to this resource-exhaustion issue?

Stateful Streamable HTTP servers using the MCP Python SDK are affected, including FastMCP, MCPServer, Server.streamable_http_app(), and StreamableHTTPSessionManager. Stateless HTTP, stdio, and SSE transports are not affected.

Q: What does an attacker need to exploit the issue?

An attacker only needs network reachability to the affected Streamable HTTP endpoint. They can send ordinary short requests that create retained session entries and cause memory growth over time.

Q: Does ending or rejecting a session prevent the memory accumulation?

Not reliably. DELETE requests, refused opening requests, and completed sessions can all leave their session entries retained.

Q: What versions contain the fix?

The issue is fixed in MCP Python SDK versions 1.30.0 and 2.2.0. Affected releases are from 1.8.0 until those fixed versions.

Published Oct 14, 2026

Updated

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.8.0 until 1.30.0 and 2.2.0, stateful Streamable HTTP servers, including FastMCP, MCPServer, Server.streamablehttpapp(), and StreamableHTTPSessionManager, retain session entries without an idle expiration or aggregate session-count limit. DELETE, refused opening requests, and completed sessions do not reliably discard their entries, and each entry can retain parsed initialize parameters. A client that can reach the endpoint can therefore create ordinary short requests that grow server memory without bound until restart. Stateless HTTP, stdio, and SSE transports are not affected. This issue is fixed in versions 1.30.0 and 2.2.0.

Affected Software

1 affected component

pypi/mcp>=1.8.0<1.30.0, >=2.0.0<2.2.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade mcp to a version that resolves this vulnerability.
Fixed in 1.30.0
Upgrade
Upgrade mcp to a version that resolves this vulnerability.
Fixed in 2.2.0

Event History

Oct 14, 2026

CVE Published

via MITRE·04:22 PM

Data Sourced

via MITRE·04:22 PM

DescriptionWeakness

Frequently Asked Questions

Which deployments are exposed to this resource-exhaustion issue?

Stateful Streamable HTTP servers using the MCP Python SDK are affected, including FastMCP, MCPServer, Server.streamable_http_app(), and StreamableHTTPSessionManager. Stateless HTTP, stdio, and SSE transports are not affected.

What does an attacker need to exploit the issue?