{"id":"EUVD-2026-80823","enisaUuid":"b35e1012-8b6e-3b5b-a145-c06668efe9ba","description":"RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate\u0027s stateful Streamable HTTP server in crates/rmcp/src/transport/streamable_http_server/tower.rs allows an unauthenticated client to send a well-formed JSON-RPC POST that is not an initialization request, or an initialization request with a mismatched protocol header, causing StreamableHttpService::handle_post to call LocalSessionManager.create_session before validating the message. An early validation failure returns without removing the inserted LocalSessionHandle from LocalSessionManager.sessions, permanently retaining session and channel state for the server process lifetime. Repeated requests can grow the shared session table without bound, degrade legitimate-client latency through lock contention, exhaust memory, and terminate the server. This issue is fixed in version 2.0.0.","datePublished":"Sep 16, 2026, 2:49:04 PM","dateUpdated":"Sep 16, 2026, 3:18:37 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/modelcontextprotocol/rust-sdk/security/advisories/GHSA-9pj6-vhgr-3mwh\nhttps://github.com/modelcontextprotocol/rust-sdk/pull/934\nhttps://github.com/modelcontextprotocol/rust-sdk/commit/dfa7fd6f9309deab60bea230b041be9a3fcda846\nhttps://github.com/modelcontextprotocol/rust-sdk/releases/tag/rmcp-v2.0.0\n","aliases":"CVE-2026-63128\nGHSA-9pj6-vhgr-3mwh\n","assigner":"GitHub_M","epss":0.54,"enisaIdProduct":[{"id":"c2921706-e3ce-3bb0-af44-e0e4b49bb4e6","product":{"name":"rust-sdk","vendor":{"name":"modelcontextprotocol"}},"product_version":"\u003c 2.0.0"}],"enisaIdVendor":[{"id":"bc3a0618-e56b-3c74-aee5-b740f0ca8ac1","vendor":{"name":"modelcontextprotocol"}}],"enisaIdVulnerability":[{"id":"6e7f0c33-d952-31c8-abfd-68df71237acf","vulnerability":{"id":"GHSA-9pj6-vhgr-3mwh","description":"RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service","datePublished":"Sep 16, 2026, 10:13:34 PM","dateUpdated":"Sep 16, 2026, 10:13:34 PM","baseScore":0.0,"references":"https://github.com/modelcontextprotocol/rust-sdk/security/advisories/GHSA-9pj6-vhgr-3mwh\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-63128\nhttps://github.com/modelcontextprotocol/rust-sdk/pull/934\nhttps://github.com/modelcontextprotocol/rust-sdk/commit/dfa7fd6f9309deab60bea230b041be9a3fcda846\nhttps://github.com/modelcontextprotocol/rust-sdk\nhttps://github.com/modelcontextprotocol/rust-sdk/releases/tag/rmcp-v2.0.0\n","enisa_id":"EUVD-2026-80823\n","aliases":"CVE-2026-63128\nGHSA-9pj6-vhgr-3mwh\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 2:01:07 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"7941d3b9-f4c4-3013-86b4-31aa55409af2","vulnerability":{"id":"CVE-2026-63128","description":"RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate\u0027s stateful Streamable HTTP server in crates/rmcp/src/transport/streamable_http_server/tower.rs allows an unauthenticated client to send a well-formed JSON-RPC POST that is not an initialization request, or an initialization request with a mismatched protocol header, causing StreamableHttpService::handle_post to call LocalSessionManager.create_session before validating the message. An early validation failure returns without removing the inserted LocalSessionHandle from LocalSessionManager.sessions, permanently retaining session and channel state for the server process lifetime. Repeated requests can grow the shared session table without bound, degrade legitimate-client latency through lock contention, exhaust memory, and terminate the server. This issue is fixed in version 2.0.0.","datePublished":"Sep 16, 2026, 2:49:04 PM","dateUpdated":"Sep 16, 2026, 3:18:37 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/modelcontextprotocol/rust-sdk/security/advisories/GHSA-9pj6-vhgr-3mwh\nhttps://github.com/modelcontextprotocol/rust-sdk/pull/934\nhttps://github.com/modelcontextprotocol/rust-sdk/commit/dfa7fd6f9309deab60bea230b041be9a3fcda846\nhttps://github.com/modelcontextprotocol/rust-sdk/releases/tag/rmcp-v2.0.0\n","enisa_id":"EUVD-2026-80823\n","assigner":"GitHub_M","epss":0.54,"dataProcessed":"Oct 28, 2026, 7:15:21 AM","vulnerabilityProduct":[{"id":"ee71f63a-bcbb-31e2-8918-847f89e17a36","product":{"name":"rust-sdk","vendor":{"name":"modelcontextprotocol"}},"product_version":"\u003c 2.0.0"}],"vulnerabilityVendor":[{"id":"cc57a448-5cab-31b3-b9ff-c926785c61af","vendor":{"name":"modelcontextprotocol"}}]}}],"enisaIdAdvisory":[{"id":"2f9b860a-40c4-3765-8a0d-2148d13a678a","advisory":{"id":"WID-SEC-W-2026-3883","description":"Red Hat Enterprise Linux (goose, environment-modules, tornado): Mehrere Schwachstellen","summary":"Ein Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, beliebigen Code auszuführen oder Denial-of-Service-Zustände herbeizuführen.","datePublished":"Oct 12, 2026, 10:00:00 PM","dateUpdated":"Oct 25, 2026, 11:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3883.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2026-3883\n","aliases":"CVE-2026-63127\nCVE-2026-63128\nCVE-2026-72718\nCVE-2026-93599\nCVE-2026-85013\nCVE-2026-103262\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"06f71cc1-769d-3532-ac53-bb674106f847","product":{"name":"Red Hat Enterprise Linux","vendor":{"name":"Red Hat"}}},{"id":"14814c53-0534-32fb-a230-6ce40028401b","product":{"name":"9","vendor":{"name":"NetApp"}}},{"id":"2628d7dc-4f13-3632-869f-d5683ca2a237","product":{"name":"RESF Rocky Linux","vendor":{"name":"RESF"}}},{"id":"459b7cc8-f165-31f1-9d5f-63402d86f00c","product":{"name":"10","vendor":{"name":"Johnson Controls Inc"}}},{"id":"56e7d17a-ea94-3e2c-b6f6-925bd337e1c6","product":{"name":"Amazon Linux 2","vendor":{"name":"Amazon"}}},{"id":"bac4a821-7df8-3c98-afb3-d96157ef2547","product":{"name":"Enterprise Linux","vendor":{"name":"Red Hat"}}},{"id":"e16a2a27-a9ff-3398-8827-f87c3a80e715","product":{"name":"Ubuntu Linux","vendor":{"name":"Canonical"}}},{"id":"ea04b3e6-9677-3a39-9083-3b5a24f96ff2","product":{"name":"Oracle Linux","vendor":{"name":"Oracle Corporation"}}}]}},{"id":"9acddce8-2204-3440-a31c-076c3e62cc7b","advisory":{"id":"openSUSE-SU-2026:11849-1","description":"openai-codex-0.155.1-1.1 on GA media","summary":"openai-codex-0.155.1-1.1 on GA media","datePublished":"Sep 22, 2026, 12:00:00 AM","dateUpdated":"Sep 23, 2026, 8:33:17 AM","baseScore":0.0,"references":"https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_11849-1.json\nhttps://www.suse.com/security/cve/CVE-2026-63127/\nhttps://www.suse.com/security/cve/CVE-2026-63128/\nhttps://www.suse.com/security/cve/CVE-2026-64684/\n","aliases":"CVE-2026-63127\nCVE-2026-63128\nCVE-2026-64684\n","source":{"id":21,"name":"csaf_opensuse"},"advisoryProduct":[{"id":"1415397c-3ec8-3ead-b743-b263bcfd79bd","product":{"name":"openai-codex-fish-completion-0:0.155.1-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"2153049d-f1a0-3e14-b77f-19f0d282da95","product":{"name":"openai-codex-zsh-completion-0:0.155.1-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"279da4ec-5231-3256-92f5-8cbb5a0f8a66","product":{"name":"openai-codex-bash-completion-0:0.155.1-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"46b83533-23cf-3f77-ad5a-91b1f1b10e8f","product":{"name":"openai-codex-zsh-completion-0:0.155.1-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"688e9e22-00ae-3a45-b9ee-c126a11ba447","product":{"name":"openai-codex-0:0.155.1-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"7d625da1-e60f-3d2c-94e1-2458d85d7230","product":{"name":"openai-codex-bash-completion-0:0.155.1-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"7f4449dc-de12-3a4e-bec2-e1e16db99632","product":{"name":"openai-codex-0:0.155.1-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"7f8a561d-3059-3f80-a08f-73f1bfcec069","product":{"name":"openai-codex-zsh-completion-0:0.155.1-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"810903c8-2fac-34a3-8091-211d5edd6adb","product":{"name":"openai-codex-fish-completion-0:0.155.1-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"a4088ab2-8b4f-3c05-be5a-fa39c82730b9","product":{"name":"openai-codex-bash-completion-0:0.155.1-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"bfa2be11-009d-3fec-94d7-d46e8fee588d","product":{"name":"openai-codex-fish-completion-0:0.155.1-1.1.aarch64","vendor":{"name":"SUSE"}}},{"id":"bfed0193-7bdf-370b-9154-0a2e0f4ea24d","product":{"name":"openai-codex-0:0.155.1-1.1.x86_64","vendor":{"name":"SUSE"}}},{"id":"c4bde4ca-c403-3d25-a644-0c510274d9d2","product":{"name":"openSUSE Tumbleweed","vendor":{"name":"SUSE"}}},{"id":"c5348a95-c3fc-361d-9b0a-c1cfe8063e2b","product":{"name":"openai-codex-0:0.155.1-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"e3df8ad1-3aa4-3e15-b1d0-67f93efe0a08","product":{"name":"openai-codex-bash-completion-0:0.155.1-1.1.s390x","vendor":{"name":"SUSE"}}},{"id":"f4a38003-f788-367b-8af1-760ec312d727","product":{"name":"openai-codex-fish-completion-0:0.155.1-1.1.ppc64le","vendor":{"name":"SUSE"}}},{"id":"f764675f-69c8-3752-bffd-2cf68ca5d5d3","product":{"name":"openai-codex-zsh-completion-0:0.155.1-1.1.ppc64le","vendor":{"name":"SUSE"}}}]}},{"id":"de49c790-8fcf-3ad9-b3f3-f6eaaa7fd55a","advisory":{"id":"RHSA-2026:80765","description":"Red Hat Security Advisory: goose security update","summary":"An update for goose is now available for Red Hat Enterprise Linux 10.","datePublished":"Oct 12, 2026, 1:06:56 PM","dateUpdated":"Oct 22, 2026, 6:01:06 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:80765\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_80765.json\n","aliases":"CVE-2026-63127\nCVE-2026-63128\nCVE-2026-72718\nCVE-2026-93599\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"03d502bd-d7ba-3116-9822-4d79be687bc9","product":{"name":"goose-0:1.45.0-1.el10_2.s390x","vendor":{"name":"Red Hat"}}},{"id":"07bcb1bc-4467-376d-8cd5-06fa2fddeba0","product":{"name":"goose-0:1.45.0-1.el10_2.src","vendor":{"name":"Red Hat"}}},{"id":"0a62c265-17ae-37d9-8dcc-b15986372c15","product":{"name":"goose-0:1.45.0-1.el10_2.x86_64","vendor":{"name":"Red Hat"}}},{"id":"0b8eff9c-9654-30a1-ae87-393188577ce2","product":{"name":"goose-debugsource-0:1.45.0-1.el10_2.ppc64le","vendor":{"name":"Red Hat"}}},{"id":"3aaee2d3-0580-36df-ad88-7d30a9eb3ed1","product":{"name":"goose-debuginfo-0:1.45.0-1.el10_2.x86_64","vendor":{"name":"Red Hat"}}},{"id":"4c548615-42ca-30a0-ab03-6b8b55972a9f","product":{"name":"goose-debuginfo-0:1.45.0-1.el10_2.aarch64","vendor":{"name":"Red Hat"}}},{"id":"6057c1b9-db31-376a-8ef2-98e7f3504917","product":{"name":"goose-debuginfo-0:1.45.0-1.el10_2.s390x","vendor":{"name":"Red Hat"}}},{"id":"863cd5d2-56bc-3a7e-8f3b-7f489cad2da2","product":{"name":"goose-0:1.45.0-1.el10_2.ppc64le","vendor":{"name":"Red Hat"}}},{"id":"8bbf6391-82d1-356a-9144-44df7f54f98d","product":{"name":"goose-debugsource-0:1.45.0-1.el10_2.x86_64","vendor":{"name":"Red Hat"}}},{"id":"9383745a-ec60-30ca-ab79-39dc512aa319","product":{"name":"goose-debuginfo-0:1.45.0-1.el10_2.ppc64le","vendor":{"name":"Red Hat"}}},{"id":"a6a87ad6-5270-3eb0-b4ec-3439dbb6a0b1","product":{"name":"goose-debugsource-0:1.45.0-1.el10_2.aarch64","vendor":{"name":"Red Hat"}}},{"id":"ae5d1b0a-884e-3fb7-97f9-fb7b3b4ac806","product":{"name":"goose-debugsource-0:1.45.0-1.el10_2.s390x","vendor":{"name":"Red Hat"}}},{"id":"b32ef468-d844-3f1e-aceb-f1e5c8402878","product":{"name":"goose-0:1.45.0-1.el10_2.aarch64","vendor":{"name":"Red Hat"}}},{"id":"ce3f5ae3-d8bc-316e-849e-86718ef1e6e1","product":{"name":"Red Hat Enterprise Linux Extensions Channel (v. 10)","vendor":{"name":"Red Hat"}}}]}},{"id":"f0fa2be0-e0ef-3841-9311-adf1358436e6","advisory":{"id":"RHSA-2026:80764","description":"Red Hat Security Advisory: goose security update","summary":"An update for goose is now available for Red Hat Enterprise Linux 9.","datePublished":"Oct 12, 2026, 1:06:45 PM","dateUpdated":"Oct 22, 2026, 6:01:05 AM","baseScore":0.0,"references":"https://access.redhat.com/errata/RHSA-2026:80764\nhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_80764.json\n","aliases":"CVE-2026-63127\nCVE-2026-63128\nCVE-2026-72718\nCVE-2026-93599\n","source":{"id":9,"name":"csaf_redhat"},"advisoryProduct":[{"id":"02dc3247-070e-3e5b-832c-6fdebe1b2f25","product":{"name":"goose-0:1.45.0-1.el9_8.x86_64","vendor":{"name":"Red Hat"}}},{"id":"0a4ef8a8-911f-3640-bdef-3674ea71de03","product":{"name":"goose-debuginfo-0:1.45.0-1.el9_8.x86_64","vendor":{"name":"Red Hat"}}},{"id":"1f35ff40-72a8-3945-be1f-bbd9a1046cb8","product":{"name":"goose-debugsource-0:1.45.0-1.el9_8.s390x","vendor":{"name":"Red Hat"}}},{"id":"41f44d85-5ee4-3bee-b776-b2bf9bfa65c6","product":{"name":"goose-0:1.45.0-1.el9_8.ppc64le","vendor":{"name":"Red Hat"}}},{"id":"4ff54b08-f728-3265-aa9d-bf492ab973f0","product":{"name":"goose-0:1.45.0-1.el9_8.s390x","vendor":{"name":"Red Hat"}}},{"id":"596fac49-1def-3740-8c22-698be034cea8","product":{"name":"goose-debugsource-0:1.45.0-1.el9_8.ppc64le","vendor":{"name":"Red Hat"}}},{"id":"5ee20cbe-7781-396a-9663-2a01efcac180","product":{"name":"goose-debuginfo-0:1.45.0-1.el9_8.aarch64","vendor":{"name":"Red Hat"}}},{"id":"77a18ef1-bf38-38d8-b629-60be4a360976","product":{"name":"goose-debugsource-0:1.45.0-1.el9_8.x86_64","vendor":{"name":"Red Hat"}}},{"id":"7f9a5c22-8edd-319e-b581-819c1a3722a9","product":{"name":"goose-0:1.45.0-1.el9_8.aarch64","vendor":{"name":"Red Hat"}}},{"id":"92384754-f9c2-32bd-a7b4-6425f8969dc6","product":{"name":"goose-debuginfo-0:1.45.0-1.el9_8.s390x","vendor":{"name":"Red Hat"}}},{"id":"a493d4a5-c9ed-3376-9f8b-44c00027bed8","product":{"name":"Red Hat Enterprise Linux Extensions Channel (v. 9)","vendor":{"name":"Red Hat"}}},{"id":"c544758f-acbe-3997-9d1a-5cda3ecf2104","product":{"name":"goose-debuginfo-0:1.45.0-1.el9_8.ppc64le","vendor":{"name":"Red Hat"}}},{"id":"c6acbf9b-0dab-3b9e-9295-cf4167e9f1ea","product":{"name":"goose-0:1.45.0-1.el9_8.src","vendor":{"name":"Red Hat"}}},{"id":"c8e3a296-4a66-3168-98a7-889c57aa5ae6","product":{"name":"goose-debugsource-0:1.45.0-1.el9_8.aarch64","vendor":{"name":"Red Hat"}}}]}}]}