CVE-2026-59951

Awaiting Analysis Awaiting Analysis - Queue

Memory Leak in MCP Python SDK HTTP Sessions

Publication date: 2026-10-14

Last updated on: 2026-10-15

Assigner: GitHub, Inc.

Description

The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.8.0 until 1.30.0 and 2.2.0, stateful Streamable HTTP servers, including FastMCP, MCPServer, Server.streamable_http_app(), and StreamableHTTPSessionManager, retain session entries without an idle expiration or aggregate session-count limit. DELETE, refused opening requests, and completed sessions do not reliably discard their entries, and each entry can retain parsed initialize parameters. A client that can reach the endpoint can therefore create ordinary short requests that grow server memory without bound until restart. Stateless HTTP, stdio, and SSE transports are not affected. This issue is fixed in versions 1.30.0 and 2.2.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-59951

EUVD

EUVD-2026-101452

Affected Vendors & Products

Vendor	Product	Version / Range
modelcontextprotocol	python-sdk	>= 1.8.0, < 1.30.0
modelcontextprotocol	python-sdk	>= 2.0.0, < 2.2.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-772	The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability in the MCP Python SDK (versions 1.8.0 to 1.30.0 and 2.0.0 to 2.2.0) involves stateful Streamable HTTP servers failing to expire idle sessions or limit concurrent sessions. This allows unauthenticated clients to create unlimited sessions, consuming server memory until restart. Stateless HTTP, stdio, and SSE transports are unaffected.

Detection Guidance

Check for unusually high memory usage in MCP Python SDK processes running Streamable HTTP servers. Monitor for sessions persisting beyond expected timeframes. Use server logs to identify sessions that are not being cleaned up after client disconnections or failed requests.

Impact Analysis

An attacker could exploit this to cause a denial-of-service by exhausting server memory, leading to crashes or degraded performance. Servers may become unresponsive or require frequent restarts to reclaim resources.

Compliance Impact

This vulnerability could lead to resource exhaustion attacks, causing servers to crash or become unresponsive. For GDPR, this may impact availability of services processing personal data, potentially violating Article 32 requirements for security and resilience. For HIPAA, it could disrupt access to protected health information systems, affecting availability requirements under the Security Rule.

Mitigation Strategies

Upgrade to MCP Python SDK versions 1.30.0 or 2.2.0 or later. Alternatively, disable stateful sessions by setting stateless_http=True in your server configuration. Restrict access to Streamable HTTP endpoints to trusted clients only.

Hi! I’m here to help you understand CVE-2026-59951. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70