CVE-2026-59951 | modelcontextprotocol python-sdk up to 1.29.x/2.1.x Streamable HTTP Server.streamable_http_app allocation of resources

October 14, 2026 Yanac

A vulnerability labeled as problematic has been found in modelcontextprotocol python-sdk up to 1.29.x/2.1.x. Affected is the function Server.streamable_http_app of the component Streamable HTTP. Such manipulation leads to allocation of resources.

This vulnerability is uniquely identified as CVE-2026-59951. The attack can be launched remotely. No exploit exists.

The affected component should be upgraded.VulDB Recent EntriesRead More