https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 22:40:52 +0000 https://vulnerability.circl.lu/vuln/cve-2026-27896 <p><strong>Affected:</strong> modelcontextprotocol go-sdk, Red Hat Migration Toolkit for Virtualization, Red Hat OpenShift Lightspeed, Red Hat OpenShift Serverless, Red Hat OpenShift AI (RHOAI)</p> <p>The Go MCP SDK used Go&#39;s standard encoding/json.Unmarshal for JSON-RPC and MCP protocol message parsing in versions prior to 1.3.1. Go&#39;s standard library performs case-insensitive matching of JSON keys to struct field tags — a field tagged json:&#34;method&#34; would also match &#34;Method&#34;, &#34;METHOD&#34;, etc. This violated the JSON-RPC 2.0 specification, which defines exact field names. A malicious MCP peer may have been able to send protocol messages with non-standard field casing that the SDK would silently accept. This had the potential for bypassing intermediary inspection and coss-implementation inconsistency. Go&#39;s standard JSON unmarshaling was replaced with a case-sensitive decoder in commit 7b8d81c. Users are advised to update to v1.3.1 to resolve this issue.</p> <p><strong>Affected:</strong> modelcontextprotocol go-sdk, Red Hat Migration Toolkit for Virtualization, Red Hat OpenShift Lightspeed, Red Hat OpenShift Serverless, Red Hat OpenShift AI (RHOAI)</p> <p>The Go MCP SDK used Go&#39;s standard encoding/json.Unmarshal for JSON-RPC and MCP protocol message parsing in versions prior to 1.3.1. Go&#39;s standard library performs case-insensitive matching of JSON keys to struct field tags — a field tagged json:&#34;method&#34; would also match &#34;Method&#34;, &#34;METHOD&#34;, etc. This violated the JSON-RPC 2.0 specification, which defines exact field names. A malicious MCP peer may have been able to send protocol messages with non-standard field casing that the SDK would silently accept. This had the potential for bypassing intermediary inspection and coss-implementation inconsistency. Go&#39;s standard JSON unmarshaling was replaced with a case-sensitive decoder in commit 7b8d81c. Users are advised to update to v1.3.1 to resolve this issue.</p> https://vulnerability.circl.lu/vuln/cve-2026-27896