CVE-2026-63128: RMCP Streamable HTTP server unauthenticated session-table memory leak

CVE-2026-63128 · Severity: high · CVSS 7.5 · Published 2026-09-16

The rmcp library's Streamable HTTP server transport (used in IDEs and local agents to expose Model Context Protocol functionality) contains a memory leak that allows any unauthenticated attacker on the same network to exhaust the server's RAM. By sending specially crafted requests, an attacker forces the server to permanently retain session objects that should be cleaned up, accumulating 400–550 bytes per request. At the demonstrated rate of 2,000+ requests per second from a single client, the server would consume 84 GB of memory in a single day before crashing, while also slowing down legitimate users through internal lock contention.

Technologies: Anthropic Model Context Protocol, rmcp (crates.io). Vendors: Anthropic, crates.io.

Quick answers

Is CVE-2026-63128 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-63128 being exploited in the wild.
How severe is CVE-2026-63128?
High severity, with a CVSS score of 7.5, published 16 September 2026.
Which products and versions are affected?
Anthropic Model Context Protocol < 2.0.0; rmcp (crates.io) < 2.0.0, SEMVER:introduced=0,fixed=2.0.0.
Is there a fix for CVE-2026-63128?
Yes. rmcp (crates.io): upgrade to 2.0.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-63128 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-63128?
Check whether you run Anthropic Model Context Protocol or rmcp (crates.io) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • rmcp (crates.io): upgrade to 2.0.0 or later
    cargo update -p rmcp

Technical details

The vulnerability is a resource exhaustion flaw in `StreamableHttpService::handle_post` (crates/rmcp/src/transport/streamable_http_server/tower.rs). The root cause is an order-of-operations bug: the handler calls `session_manager.create_session()` to allocate a `LocalSessionHandle` and insert it into a shared `HashMap`, then immediately validates the incoming request body. If validation fails (e.g., the request is not an `InitializeRequest`), the function returns early without ever calling `close_session()`. The allocated `LocalSessionHandle` and its associated tokio mpsc channel remain in the `LocalSessionManager.sessions` HashMap indefinitely because cleanup only occurs in two code paths: the success case (which is never reached on validation failure) and explicit HTTP DELETE requests. The attack is network-reachable without authentication on default configurations, since the default `allowed_hosts` accepts loopback traffic and any co-resident process qualifies as an attacker. Performance is further degraded because all session operations require acquiring a `RwLock` over the growing HashMap, causing write-lock starvation for legitimate clients. Patched in version 2.0.0.

Affected products

  • modelcontextprotocol rmcp < 2.0.0

Identifiers

  • CVE-2026-63128
  • GHSA-9pj6-vhgr-3mwh

Timeline

  • 2026-06-29: disclosed: Published as GHSA-9pj6-vhgr-3mwh
  • 2026-09-16: advisory
  • 2026-09-16: patched: Fixed in version 2.0.0

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.