Repository navigation
[SECURITY] Status of DNS Rebinding Vulnerability Fix for rust-sdk #815
Description
I found (and reported to Anthropic here) that all major MCP Server SDKs were vulnerable to browser-based DNS rebinding allowing malicious websites to talk to locally or private network connected MCP servers.
This is was in violation of the MCP specification : https://modelcontextprotocol.io/specification/2025-06-18/basic/transports#security-warning
This resulted in a slew of CVEs assigned to every major SDK:
It's not clear to me what version, if it was at all, of the rust-sdk this was fixed in, as no CVE was assigned. Would the project maintainers behind this project be so kind as to do create a GitHub Security Advisory and request a CVE including the fix version and credit myself?
Thanks team!
Activity
JLLeitschuh commentedon Apr 17, 2026
See also: modelcontextprotocol/csharp-sdk#1520
DaleSeo commentedon Apr 21, 2026
Hi @JLLeitschuh — thanks for the report and the follow-up.
I believe the fix already landed in PR #764 and was first released in v1.4.0 on 2026-04-09.
@alexhancock Do you want me to file a GitHub Security Advisory? I've never done it before but I can give it a try 😅
JLLeitschuh commentedon Apr 22, 2026
Let me know if you have any issues. Getting a CVE number is the best way to signal to your downstream users that this vulnerability was present and that they need to update their SDK version to adequately fix the issue. Without a CVE number, end-users are unlikely to update quickly
DaleSeo commentedon Apr 22, 2026
@JLLeitschuh @alexhancock The GitHub Security Advisory is drafted at GHSA-89vp-x53w-74fx. If you want any wording changed, the draft is editable, or leave comments here and I'll fold them in before publishing.
JLLeitschuh commentedon Apr 24, 2026
This looks good to me! 🎉 Great write up!
alexhancock commentedon Apr 24, 2026
Thanks for doing it @DaleSeo
How do we get a CVE number @JLLeitschuh ?
JLLeitschuh commentedon Apr 24, 2026
There should be a "Request CVE Number" down at the bottom, GitHub will issue you one
alexhancock commentedon Apr 24, 2026
I requested it
@DaleSeo Good to publish in your view?
@JLLeitschuh Do you know if we should wait for the CVE to be issued before publishing or does it not matter?
JLLeitschuh commentedon Apr 24, 2026
Ideal to wait, it will probably happen by Monday
DaleSeo commentedon Apr 28, 2026
A CVE number hasn't been assigned yet. The advisory still shows
cve_id: nullas of today. I'll publish the advisory as soon as the CVE comes in, which will automatically close this issue.DaleSeo commentedon Apr 29, 2026
The advisory has been published.
alexhancock commentedon Jul 30, 2026
Removing P0. This was advisory/CVE coordination, not critical-bug resolution.