PT-2025-28027 · Unknown · Mcp Python Sdk

Published 2025-07-04 · Updated 2026-01-22 · CVE-2025-53366

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: MCP Python SDK versions prior to 1.9.4

Description: A validation error in the MCP SDK can cause an unhandled exception when processing malformed requests, resulting in service unavailability until manually restarted. The impact may vary depending on the deployment conditions and the presence of infrastructure-level resilience measures.

Recommendations: For versions prior to 1.9.4, update to version 1.9.4 to fix the validation error and prevent service unavailability due to unhandled exceptions when processing malformed requests.

Exploit

Fix

DoS

Weakness Enumeration

CWE-248

Related Identifiers

BDU:2026-00094

CVE-2025-53366

GHSA-3QHF-M339-9G5V

Affected Products

Mcp Python Sdk

References · 16

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/53xxx/CVE-2025-53366.json · Exploit
• https://bdu.fstec.ru/vul/2026-00094 · Security Note
• https://osv.dev/vulnerability/CVE-2025-53366 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2025-53366 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3qhf-m339-9g5v · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-53366 · Security Note
• https://github.com/modelcontextprotocol/python-sdk · Note
• https://github.com/modelcontextprotocol/python-sdk/commit/29c69e6a47d0104d0afcea6ac35e7ab02fde809a · Note
• https://github.com/modelcontextprotocol/python-sdk/pull/822 · Note
• https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-3qhf-m339-9g5v · Note
• https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.9.4 · Note
• https://twitter.com/vulert_official/status/1942113037629960697 · Twitter Post
• https://twitter.com/CveFindCom/status/1941265742084612434 · Twitter Post
• https://t.me/cvenotify/127737 · Telegram Post
• https://twitter.com/CVEnew/status/1941259656367648956 · Twitter Post