p PatchFirst

CVE-2026-42559

CVE-2026-42559 · RMCP: DNS rebinding vulnerability in rmcp Streamable HTTP server transport

This page contains facts from public vulnerability sources. Check the original advisory before updating.

RMCP is an official Rust SDK for the Model Context Protocol. Prior to version 1.4.0, the rmcp crate's Streamable HTTP server transport (crates/rmcp/src/transport/streamable_http_server/) did not validate the incoming Host header. This allowed a malicious public website, via a DNS rebinding attack, to send authenticated requests to an MCP server running on the victim's loopback or private-network interface. This vulnerability is fixed in 1.4.0.

CVSS 8.8 · High · EPSS 0.3% · Fix available

Published
Updated

Stack: node

Affected products and versions

  • rust-sdk

    Versions
    • < 1.4.0: Affected

    No fix published

  • dynoxide-rs crates.io

    Affected ranges
    • SEMVER: ≥ 0.9.3, < 0.9.13

    Update to 0.9.13

  • dynoxide npm

    Affected ranges
    • SEMVER: ≥ 0.9.3, < 0.9.13

    Update to 0.9.13

Original sources

Check your server →