{"id":"EUVD-2026-8792","enisaUuid":"85886964-20bb-39e2-a870-d944b9f92355","description":"The Go MCP SDK used Go\u0027s standard encoding/json.Unmarshal for JSON-RPC and MCP protocol message parsing in versions prior to 1.3.1. Go\u0027s standard library performs case-insensitive matching of JSON keys to struct field tags — a field tagged json:\"method\" would also match \"Method\", \"METHOD\", etc. This violated the JSON-RPC 2.0 specification, which defines exact field names. A malicious MCP peer may have been able to send protocol messages with non-standard field casing that the SDK would silently accept. This had the potential for bypassing intermediary inspection and coss-implementation inconsistency. Go\u0027s standard JSON unmarshaling was replaced with a case-sensitive decoder in commit 7b8d81c. Users are advised to update to v1.3.1 to resolve this issue.","datePublished":"Feb 26, 2026, 12:47:46 AM","dateUpdated":"Sep 16, 2026, 12:04:21 PM","baseScore":7.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","references":"https://github.com/modelcontextprotocol/go-sdk/security/advisories/GHSA-wvj2-96wp-fq3f\nhttps://github.com/modelcontextprotocol/go-sdk/commit/7b8d81c264074404abdf5aa16e2cf0c2d9c64cc0\n","aliases":"CVE-2026-27896\nGHSA-wvj2-96wp-fq3f\n","assigner":"GitHub_M","epss":0.29,"enisaIdProduct":[{"id":"e4d9c2f2-def7-3918-827b-9a8575d1204d","product":{"name":"go-sdk","vendor":{"name":"modelcontextprotocol"}},"product_version":"\u003c 1.3.1"}],"enisaIdVendor":[{"id":"31c2e9ec-aa9d-3bc4-87f4-3ecb4791acbf","vendor":{"name":"modelcontextprotocol"}}],"enisaIdVulnerability":[{"id":"3a504042-b72e-3542-9d63-c705a06d5d0b","vulnerability":{"id":"GHSA-wvj2-96wp-fq3f","description":"MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity","datePublished":"Feb 26, 2026, 10:20:08 PM","dateUpdated":"Feb 26, 2026, 10:20:08 PM","baseScore":0.0,"references":"https://github.com/modelcontextprotocol/go-sdk/security/advisories/GHSA-wvj2-96wp-fq3f\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-27896\nhttps://github.com/modelcontextprotocol/go-sdk/commit/7b8d81c264074404abdf5aa16e2cf0c2d9c64cc0\nhttps://github.com/modelcontextprotocol/go-sdk\n","enisa_id":"EUVD-2026-8792\n","aliases":"CVE-2026-27896\nGHSA-wvj2-96wp-fq3f\n","epss":0.0,"dataProcessed":"Nov 9, 2026, 3:46:27 PM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"e9b9db4c-17e7-3e18-9e45-f72861a15230","vulnerability":{"id":"CVE-2026-27896","description":"The Go MCP SDK used Go\u0027s standard encoding/json.Unmarshal for JSON-RPC and MCP protocol message parsing in versions prior to 1.3.1. Go\u0027s standard library performs case-insensitive matching of JSON keys to struct field tags — a field tagged json:\"method\" would also match \"Method\", \"METHOD\", etc. This violated the JSON-RPC 2.0 specification, which defines exact field names. A malicious MCP peer may have been able to send protocol messages with non-standard field casing that the SDK would silently accept. This had the potential for bypassing intermediary inspection and coss-implementation inconsistency. Go\u0027s standard JSON unmarshaling was replaced with a case-sensitive decoder in commit 7b8d81c. Users are advised to update to v1.3.1 to resolve this issue.","datePublished":"Feb 26, 2026, 12:47:46 AM","dateUpdated":"Sep 16, 2026, 12:04:21 PM","status":"PUBLISHED","baseScore":7.0,"baseScoreVersion":"4.0","baseScoreVector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N","references":"https://github.com/modelcontextprotocol/go-sdk/security/advisories/GHSA-wvj2-96wp-fq3f\nhttps://github.com/modelcontextprotocol/go-sdk/commit/7b8d81c264074404abdf5aa16e2cf0c2d9c64cc0\n","enisa_id":"EUVD-2026-8792\n","assigner":"GitHub_M","epss":0.29,"dataProcessed":"Nov 11, 2026, 7:22:38 AM","vulnerabilityProduct":[{"id":"05e67402-dadf-354c-be0b-af05695a72b2","product":{"name":"go-sdk","vendor":{"name":"modelcontextprotocol"}},"product_version":"\u003c 1.3.1"}],"vulnerabilityVendor":[{"id":"b42aa4bb-2f39-3625-9ca9-7a07cc7b1fd7","vendor":{"name":"modelcontextprotocol"}}]}}],"enisaIdAdvisory":[]}