Security: modelcontextprotocol/java-sdk
Security Advisories
View known security vulnerabilities and report new vulnerabilities privately to maintainers.
-
Unbounded reads when parsing Server-Sent Events in HTTP client transportsGHSA-5q7x-232h-f834 published
Aug 19, 2026 by KehrlannModerate -
Unbounded request-body reads in mcp-core HTTP server transports allow remote denial of service (CWE-770)GHSA-4x8c-5vv7-973f published
Aug 19, 2026 by KehrlannHigh -
DNS Rebinding Vulnerability in Java-SDKGHSA-8jxr-pr72-r468 published
Apr 7, 2026 by KehrlannHigh -
Hardcoded Wildcard CORS (Access-Control-Allow-Origin: *)GHSA-hv2w-8mjj-jw22 published
Mar 30, 2026 by KehrlannModerate