Memory Retention Vulnerability in MCP Python SDK Affecting FastMCP and MCPServer
CVE-2026-59951
What is CVE-2026-59951?
The MCP Python SDK, utilized in the implementation of the Model Context Protocol, contains a vulnerability within its stateful Streamable HTTP servers, including FastMCP and MCPServer. Certain versions of the SDK, from 1.8.0 to 1.30.0 and 2.2.0, fail to properly manage session retention. This oversight allows session entries to persist without an expiration mechanism or a limit on the aggregate session count. As a result, ordinary short client requests can cause server memory to continuously grow, leading to potential performance degradation or service disruption, until a server restart is required. This issue has been effectively addressed in versions 1.30.0 and 2.2.0.
Affected Version(s)
python-sdk >= 1.8.0, < 1.30.0 < 1.8.0, 1.30.0
python-sdk >= 2.0.0, < 2.2.0 < 2.0.0, 2.2.0