PyPI: mcp
CVE-2025-53365
Safety vulnerability ID: SFTY-20250704-09736
Safety legacy ID: pyup.io-77975
The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.10.0, if a client deliberately triggers an exception after establishing a streamable HTTP session, this can lead to an uncaught ClosedResourceError on the server side, causing the server to crash and requiring a restart to restore service. Impact may vary depending on the deployment conditions, and the presence of infrastructure-level resilience measures. Version 1.10.0 contains a patch for the issue.
Overview
MCP Python SDK has Unhandled Exception in Streamable HTTP Transport, Leading to Denial of Service
Advisory
The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.10.0, if a client deliberately triggers an exception after establishing a streamable HTTP session, this can lead to an uncaught ClosedResourceError on the server side, causing the server to crash and requiring a restart to restore service. Impact may vary depending on the deployment conditions, and the presence of infrastructure-level resilience measures. Version 1.10.0 contains a patch for the issue.
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20250704-09736/CVE-2025-53365
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-53365
- https://github.com/modelcontextprotocol/python-sdk/commit/7b420656de48cfdb90b39eb582e60b6d55c2f891
- https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-j975-95f5-7wqh
- https://github.com/modelcontextprotocol/python-sdk/pull/967
- https://github.com/modelcontextprotocol/python-sdk/commit/7b420656de48cfdb90b39eb582e60b6d55c2f891
- https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.10.0
- https://nvd.nist.gov/vuln/detail/CVE-2025-53365
- https://github.com/advisories/GHSA-j975-95f5-7wqh
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more