The modelcontextprotocol go-sdk versions before 1.3.1 used Go's standard encoding/json.Unmarshal for parsing JSON-RPC and MCP protocol messages. This standard library unmarshaler matches JSON keys to struct fields in a case-insensitive manner, allowing fields tagged as "method" to also match "Method", "METHOD", etc. This behavior violates the JSON-RPC 2.0 specification, which mandates exact field name matching. Consequently, a malicious MCP peer could craft protocol messages with non-standard casing to bypass intermediary inspection or cause cross-implementation inconsistencies. The vulnerability was addressed by replacing the standard unmarshaler with a case-sensitive decoder in commit 7b8d81c, and users are advised to update to version 1.3.1 or later to resolve the issue.

The vulnerability allows a malicious MCP peer to send protocol messages with non-standard field casing that the SDK would accept, violating the JSON-RPC 2.0 specification. This can lead to bypassing intermediary inspection mechanisms and cause inconsistencies between implementations that expect exact field name matching. The CVSS 4.0 score is 7, indicating a high severity impact with network attack vector, low attack complexity, and no required privileges or user interaction.

An official fix is available in version 1.3.1 of the modelcontextprotocol go-sdk, which replaces the case-insensitive JSON unmarshaler with a case-sensitive decoder. Users should update to version 1.3.1 or later to remediate this vulnerability. No additional mitigation steps are indicated by the vendor advisory.