cve.nowby Sazabi

GoPackage

github.com/modelcontextprotocol/go-sdk

3 known vulnerabilities (3 high), with the versions each affects and the releases that fix them.

Latest release: Not known: cve.now hasn't read this package's releases
Newest unaffected release: Not known without release data
Advisories: 3 · 3 high

Registry: pkg.go.dev

Advisories 3

CVE-2026-34742High 7.6
Model Context Protocol Go SDK: DNS Rebinding Protection Disabled by Default for Servers Running on Localhost
Affected: fixed in 1.4.0.
CVE-2026-33252High 7.1
MCP Go SDK Allows Cross-Site Tool Execution for HTTP Servers without Authorizatrion
Affected: fixed in 1.4.1.
CVE-2026-27896High 7.0
MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity
Affected: fixed in 1.3.1.