PT-2025-28026 · Unknown · Mcp Python Sdk

Published 2025-07-04 · Updated 2026-01-22 · CVE-2025-53365

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: MCP Python SDK versions prior to 1.10.0

Description: The issue arises when a client deliberately triggers an exception after establishing a streamable HTTP session, leading to an uncaught ClosedResourceError on the server side. This can cause the server to crash and require a restart to restore service. The impact may vary depending on deployment conditions and the presence of infrastructure-level resilience measures.

Recommendations: For versions prior to 1.10.0, update to version 1.10.0 to resolve the issue. As a temporary workaround, consider implementing measures to prevent deliberate exception triggering by clients, such as enhancing error handling or implementing rate limiting on HTTP sessions. Restrict access to the mcp SDK until the update is applied to minimize the risk of exploitation.

Exploit

Fix

Weakness Enumeration

CWE-248

Related Identifiers

BDU:2026-00095

CVE-2025-53365

GHSA-J975-95F5-7WQH

Affected Products

Mcp Python Sdk

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53365.json · Exploit
• https://osv.dev/vulnerability/CVE-2025-53365 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-j975-95f5-7wqh · Vendor Advisory
• https://bdu.fstec.ru/vul/2026-00095 · Security Note
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2025-53365 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53365 · Security Note
• https://github.com/modelcontextprotocol/python-sdk · Note
• https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-j975-95f5-7wqh · Note
• https://github.com/modelcontextprotocol/python-sdk/commit/7b420656de48cfdb90b39eb582e60b6d55c2f891 · Note
• https://github.com/modelcontextprotocol/python-sdk/pull/967 · Note
• https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.10.0 · Note
• https://t.me/cvenotify/127736 · Telegram Post
• https://twitter.com/CVEnew/status/1941259657307099374 · Twitter Post
• https://twitter.com/CveFindCom/status/1941265793993306584 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1941372167041495373 · Twitter Post