Is CVE-2026-59951 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-59951 being exploited in the wild.

How severe is CVE-2026-59951?

High severity, with a CVSS score of 7.5, published 14 October 2026.

Which products and versions are affected?

Anthropic Mcp 1.8.0 through 1.29.1, 2.0.0 through 2.1.1; mcp (PyPI) >= 1.8.0, < 1.30.0, ECOSYSTEM:introduced=1.8.0,fixed=1.30.0.

Is there a fix for CVE-2026-59951?

Yes. mcp (PyPI): upgrade to 1.30.0 or later. Until then: Pass `stateless_http=True` to disable per-session state (available in 1.12.0 or later), or restrict network access to the HTTP endpoint to trusted clients only. [ { "kind": "disclosed", "at": "2026-10-15" }, { "kind": "patched", "at": "2026-10-15", "note": "Versions 1.30.0 and 2.2.0 released with session expiry, count limits, and immediate cleanup" } ] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-59951 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-59951?

Check whether you run Anthropic Mcp or mcp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-59951: MCP Python SDK unbounded session accumulation in StreamableHTTP

Q: Is there a fix for CVE-2026-59951?

Yes. mcp (PyPI): upgrade to 1.30.0 or later. Until then: Pass `stateless_http=True` to disable per-session state (available in 1.12.0 or later), or restrict network access to the HTTP endpoint to trusted clients only. [ { "kind": "disclosed", "at": "2026-10-15" }, { "kind": "patched", "at": "2026-10-15", "note": "Versions 1.30.0 and 2.2.0 released with session expiry, count limits, and immediate cleanup" } ] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

CVE-2026-59951 · Severity: high · CVSS 7.5 · Published 2026-10-14

The MCP Python SDK's HTTP server implementation fails to clean up session state, allowing any client to exhaust server memory through repeated session creation. This causes a denial-of-service condition where only a server restart recovers the leaked memory. An attacker who can reach the endpoint can crash the service or degrade its availability.

Technologies: mcp (PyPI). Vendors: Anthropic, PyPI.

Quick answers

Is CVE-2026-59951 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-59951 being exploited in the wild.
How severe is CVE-2026-59951?: High severity, with a CVSS score of 7.5, published 14 October 2026.
Which products and versions are affected?: Anthropic Mcp 1.8.0 through 1.29.1, 2.0.0 through 2.1.1; mcp (PyPI) >= 1.8.0, < 1.30.0, ECOSYSTEM:introduced=1.8.0,fixed=1.30.0.
Is there a fix for CVE-2026-59951?: Yes. mcp (PyPI): upgrade to 1.30.0 or later. Until then: Pass `stateless_http=True` to disable per-session state (available in 1.12.0 or later), or restrict network access to the HTTP endpoint to trusted clients only.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-10-15" }, { "kind": "patched", "at": "2026-10-15", "note": "Versions 1.30.0 and 2.2.0 released with session expiry, count limits, and immediate cleanup" } ] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-59951 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-59951?: Check whether you run Anthropic Mcp or mcp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

mcp (PyPI): upgrade to 1.30.0 or later
```
pip install "mcp>=1.30.0"
```

Pass `stateless_http=True` to disable per-session state (available in 1.12.0 or later), or restrict network access to the HTTP endpoint to trusted clients only.</anigation> <parameter name="timeline">[ { "kind": "disclosed", "at": "2026-10-15" }, { "kind": "patched", "at": "2026-10-15", "note": "Versions 1.30.0 and 2.2.0 released with session expiry, count limits, and immediate cleanup" } ]

Technical details

The StreamableHTTP transport in stateful mode (default) never expires sessions, deletes them after client disconnect, or limits their count. Each session retains its parsed initialize parameters indefinitely. An unauthenticated or low-privilege client can open unbounded sessions with short requests, causing linear memory growth until the server runs out of memory or becomes unresponsive.

Affected products

Anthropic mcp 1.8.0 through 1.29.1, 2.0.0 through 2.1.1

Identifiers

CVE-2026-59951
GHSA-84m7-p3x7-pcfv

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.