modelcontextprotocol/rust-sdk

Releases78

Frequency4 days 2 hours

Last Release 23 days ago

Stars3.49K

The official Rust SDK for the Model Context Protocol

CVE History

CVE	Published	CVSS v3	CVSS v2
CVE-2026-42559 ↗	May 14, 2026Thursday, 14 May 2026, 15:16	8.8 HIGH	—
RMCP is an official Rust SDK for the Model Context Protocol. Prior to version 1.4.0, the rmcp crate's Streamable HTTP server transport (crates/rmcp/src/transport/streamable_http_server/) did not validate the incoming Host header. This allowed a malicious public website, via a DNS rebinding attack, to send authenticated requests to an MCP server running on the victim's loopback or private-network interface. This vulnerability is fixed in 1.4.0.