@modelcontextprotocol go-sdk

• CVE-2026-34742 High 8.0 Model Context Protocol Go SDK: DNS Rebinding Protection Disabled by Default for Servers Running on Localhost 0.5%
• CVE-2026-33252 High 7.1 MCP Go SDK Allows Cross-Site Tool Execution for HTTP Servers without Authorizatrion 0.2%
• CVE-2026-27896 High 7.2 MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity 0.3%