Known vulnerabilities in modelcontextprotocol go-sdk
Is your version affected?
CVE list
| CVE | Summary | Score | Published |
|---|---|---|---|
| CVE-2026-34742 | The Go MCP SDK used Go's standard encoding/json | 7.6 High | Apr 2, 2026 |
| CVE-2026-33252 | The Go MCP SDK used Go's standard encoding/json | 7.1 High | Mar 23, 2026 |
| CVE-2026-27896 | The Go MCP SDK used Go's standard encoding/json.Unmarshal for JSON-RPC and MCP protocol message parsing in versions… | 7.0 High | Feb 26, 2026 |