DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-63128: CVE-2026-63128: Uncontrolled Resource Consumption in Model Context Protocol Rust SDK (rmcp)

#security #cve #cybersecurity

CVE-2026-63128: Uncontrolled Resource Consumption in Model Context Protocol Rust SDK (rmcp)

Vulnerability ID: CVE-2026-63128
CVSS Score: 7.5
Published: 2026-09-16

CVE-2026-63128 is a high-severity uncontrolled resource consumption vulnerability in the Model Context Protocol (MCP) official Rust SDK (the rmcp crate) prior to version 2.0.0. An unauthenticated attacker can exploit this vulnerability by sending malformed or mismatching handshake requests to the stateful Streamable HTTP server, causing persistent memory allocation without cleanup. This results in an unbounded memory leak and lock contention that ultimately leads to complete denial of service.

TL;DR

The stateful HTTP server in the rmcp crate allocates session resources before validating request headers and bodies. If validation fails, the server exits early without reclaiming the allocated memory, leading to an unbounded memory leak and eventual server crash.

Technical Details

  • CWE ID: CWE-400 / CWE-401 / CWE-772
  • Attack Vector: Network
  • CVSS v3.1 Score: 7.5 (High)
  • Exploit Status: None
  • CISA KEV Listed: No
  • Mitigated Version: 2.0.0

Affected Systems

  • Model Context Protocol Rust SDK (rmcp crate) prior to version 2.0.0
  • rmcp: < 2.0.0 (Fixed in: 2.0.0)

Code Analysis

Commit: dfa7fd6

Refactor stateful server initialization to validate request prior to session creation, preventing memory leak on validation failures

Mitigation Strategies

  • Upgrade the rmcp crate to version 2.0.0 or higher.
  • Implement rate-limiting on stateful Streamable HTTP POST endpoints.
  • Deploy WAF rules to validate MCP header protocol integrity before forwarding requests to the application layer.

Remediation Steps:

  1. Identify dependencies on the 'rmcp' crate within Cargo.toml.
  2. Update the dependency version to '2.0.0' or higher.
  3. Verify integration tests pass under stateful configurations.
  4. Deploy the updated application container or binary to production environments.

References

Read the full report for CVE-2026-63128 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)