@modelcontextprotocol rust-sdk

• CVE-2026-64684 Medium 6.8 RMCP: Custom HTTP headers leak to cross-origin redirect targets 0.5%
• CVE-2026-63127 High 8.2 RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery 0.2%
• CVE-2026-63128 High 7.5 RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service 0.5%
• CVE-2026-42559 High 8.8 RMCP: DNS rebinding vulnerability in rmcp Streamable HTTP server transport 0.3%