CVE-2025-53366
Last modified
CVE-2025-53366 is a high-severity vulnerability rated 8.7/10 on the CVSS scale. The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.9.4, a validation error in the MCP SDK can cause an unhandled exception when processing malformed requests, resulting in service unavailability (500 errors) until manually restarted. EPSS estimates a 5.69% chance of exploitation in the next 30 days.
Description
The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.9.4, a validation error in the MCP SDK can cause an unhandled exception when processing malformed requests, resulting in service unavailability (500 errors) until manually restarted. Impact may vary depending on the deployment conditions, and presence of infrastructure-level resilience measures. Version 1.9.4 contains a patch for the issue.
Metrics
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-53366?
How severe is CVE-2025-53366?
How do I fix CVE-2025-53366?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-53359ethereum is a common ethereum structs for Rust. Prior to eth…6.9
- CVE-2025-5336The Click to Chat plugin for WordPress is vulnerable to Stor…6.4
- CVE-2025-53360pluginsGLPI's Database Inventory Plugin "manages" the Teclib…4.3
- CVE-2025-53363dpanel is an open source server management panel written in …4.8
- CVE-2025-53364Parse Server is an open source backend that can be deployed …5.3
- CVE-2025-53365The MCP Python SDK, called `mcp` on PyPI, is a Python implem…8.7
- CVE-2025-53367DjVuLibre is a GPL implementation of DjVu, a web-centric for…8.4
- CVE-2025-53368Citizen is a MediaWiki skin that makes extensions part of th…5.4
- CVE-2025-53369Short Description is a MediaWiki extension that provides loc…8.6
- CVE-2025-5337The Slider, Gallery, and Carousel by MetaSlider plugin for W…5.4
- CVE-2025-53370Citizen is a MediaWiki skin that makes extensions part of th…5.4
- CVE-2025-53371DiscordNotifications is an extension for MediaWiki that send…9.1
Are you affected by CVE-2025-53366?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST