- Latest release
- 3.9.0 (Nov 5, 2026): no advisory affects it
- Newest unaffected release
- 3.9.0 (Nov 5, 2026), the latest release
- Advisories
- 4 · 3 high, 1 medium
- Weekly downloads
- 1.9M
- Dependents
- 0
- Releases
- 72 since 0.1.0 (Mar 16, 2025)
- Registry
- crates.io
- Releases read
- Nov 8, 2026
Version timeline
- CVE-2026-64684Affects 0.1.0 to 2.0.0 (2.1.0 is outside it)
- CVE-2026-63127Affects 0.1.0 to 1.8.0 (2.0.0 is outside it)
- CVE-2026-63128Affects 0.1.0 to 1.8.0 (2.0.0 is outside it)
- CVE-2026-42559Affects 0.1.0 to 1.3.0 (1.4.0 is outside it)
Advisories 4
- CVE-2026-64684Medium 6.8
RMCP: Custom HTTP headers leak to cross-origin redirect targets
Affected: fixed in 2.1.0.
Fixed in 2.1.0 (released Jul 2, 2026, 76 days before disclosure).
The latest release, 3.9.0, is not affected.
- CVE-2026-63127High 8.2
RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery
Affected: fixed in 2.0.0.
Fixed in 2.0.0 (released Jun 29, 2026, 79 days before disclosure).
The latest release, 3.9.0, is not affected.
- CVE-2026-63128High 7.5
RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service
Affected: fixed in 2.0.0.
Fixed in 2.0.0 (released Jun 29, 2026, 79 days before disclosure).
The latest release, 3.9.0, is not affected.
- CVE-2026-42559High 8.8
RMCP: DNS rebinding vulnerability in rmcp Streamable HTTP server transport
Affected: fixed in 1.4.0; fixed in 1.4.0.
Fixed in 1.4.0 (released Apr 10, 2026, 34 days before disclosure).
The latest release, 3.9.0, is not affected.