# CVE-2026-59951: MCP Python SDK unbounded session accumulation in StreamableHTTP

Source: https://junglewise.ai/threats/cve-2026-59951-mcp-python-sdk-unbounded-session-accumulation-in-streamablehttp  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-14. Updated: 2026-10-15  
License: CC BY 4.0 with a link back

CVE-2026-59951 · Severity: high · CVSS 7.5 · Published 2026-10-14

The MCP Python SDK's HTTP server implementation fails to clean up session state, allowing any client to exhaust server memory through repeated session creation. This causes a denial-of-service condition where only a server restart recovers the leaked memory. An attacker who can reach the endpoint can crash the service or degrade its availability.

Technologies: [mcp (PyPI)](https://junglewise.ai/threats/technologies/pypi-mcp). Vendors: [Anthropic](https://junglewise.ai/threats/vendors/anthropic), [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-59951 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59951 being exploited in the wild.

**How severe is CVE-2026-59951?** High severity, with a CVSS score of 7.5, published 14 October 2026.

**Which products and versions are affected?** Anthropic Mcp 1.8.0 through 1.29.1, 2.0.0 through 2.1.1; mcp (PyPI) >= 1.8.0, < 1.30.0, ECOSYSTEM:introduced=1.8.0,fixed=1.30.0.

**Is there a fix for CVE-2026-59951?** Yes. mcp (PyPI): upgrade to 1.30.0 or later. Until then: Pass `stateless_http=True` to disable per-session state (available in 1.12.0 or later), or restrict network access to the HTTP endpoint to trusted clients only.</anigation>
<parameter name="timeline">[
  {
    "kind": "disclosed",
    "at": "2026-10-15"
  },
  {
    "kind": "patched",
    "at": "2026-10-15",
    "note": "Versions 1.30.0 and 2.2.0 released with session expiry, count limits, and immediate cleanup"
  }
] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59951 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-59951?** Check whether you run Anthropic Mcp or mcp (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- mcp (PyPI): upgrade to 1.30.0 or later

  ```sh
  pip install "mcp>=1.30.0"
  ```


Pass `stateless_http=True` to disable per-session state (available in 1.12.0 or later), or restrict network access to the HTTP endpoint to trusted clients only.</anigation>
<parameter name="timeline">[
  {
    "kind": "disclosed",
    "at": "2026-10-15"
  },
  {
    "kind": "patched",
    "at": "2026-10-15",
    "note": "Versions 1.30.0 and 2.2.0 released with session expiry, count limits, and immediate cleanup"
  }
]

## Technical details

The StreamableHTTP transport in stateful mode (default) never expires sessions, deletes them after client disconnect, or limits their count. Each session retains its parsed initialize parameters indefinitely. An unauthenticated or low-privilege client can open unbounded sessions with short requests, causing linear memory growth until the server runs out of memory or becomes unresponsive.

## Affected products

- Anthropic mcp 1.8.0 through 1.29.1, 2.0.0 through 2.1.1

## Identifiers

- CVE-2026-59951
- GHSA-84m7-p3x7-pcfv

## Related threats

- [Model Context Protocol Python SDK unvalidated $ref fetching](https://junglewise.ai/threats/cve-2026-116686-the-model-context-protocol-python-sdk-is-the-official-python-sdk)
- [Model Context Protocol Python SDK credential and body leak on cross-origin redirects](https://junglewise.ai/threats/cve-2026-116685-the-model-context-protocol-python-sdk-is-the-official-python-sdk)
- [Model Context Protocol Python SDK token resource confusion in bearer authentication](https://junglewise.ai/threats/cve-2026-116684-the-model-context-protocol-python-sdk-is-the-official-python-sdk)
- [modelcontextprotocol python-sdk missing origin validation in WebSocket transport](https://junglewise.ai/threats/cve-2026-59950-modelcontextprotocol-python-sdk-missing-origin-validation-in)
- [Model Context Protocol Python SDK missing authorization in experimental tasks](https://junglewise.ai/threats/cve-2026-52870-model-context-protocol-python-sdk-missing-authorization-in)