Threats tagged 'ghsa-84m7-p3x7-pcfv'

CVE-2026-59951 is a medium severity vulnerability in the modelcontextprotocol python-sdk affecting versions 1.8.0 through 1.29.1 and 2.0.0 through 2.1.1. The issue involves uncontrolled resource consumption due to a Streamable HTTP server in stateful mode that never reclaims session state, allowing unlimited sessions to accumulate and consume memory. This can lead to server memory growth without bound until a restart occurs. The vulnerability is fixed in versions 1.30.0 and 2.2.0, which introduce session idle timeouts, maximum session limits, and proper session cleanup.