CVE-2026-63128: RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service
RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's stateful Streamable HTTP server in crates/rmcp/src/transport/streamablehttpserver/tower.rs allows an unauthenticated client to send a well-formed JSON-RPC POST that is not an initialization request, or an initialization request with a mismatched protocol header, causing StreamableHttpService::handlepost to call LocalSessionManager.createsession before validating the message. An early validation failure returns without removing the inserted LocalSessionHandle from LocalSessionManager.sessions, permanently retaining session and channel state for the server process lifetime. Repeated requests can grow the shared session table without bound, degrade legitimate-client latency through lock contention, exhaust memory, and terminate the server. This issue is fixed in version 2.0.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
rmcp crate's stateful Streamable HTTP server transport (crates/rmcp/src/transport/streamable_http_server/tower.rs)to a version that resolves this vulnerability.Fixed in 2.0.0
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments using the rmcp crate's stateful Streamable HTTP server transport are affected if they run a version prior to 2.0.0.
Does exploitation require an account or user interaction?
No. An unauthenticated remote client can trigger the issue without privileges or user interaction by sending a well-formed JSON-RPC POST.
What request conditions trigger the session leak?
The POST must be a non-initialization request, or an initialization request with a mismatched protocol header. In these cases, a session is created before message validation fails and is not removed.
What is the remediation?
Upgrade the rmcp crate to version 2.0.0, which fixes the issue.