CVE-2025-53365 - CVE House

Back to Database

Status published High CVE-2025-53365

MCP Python SDK has Unhandled Exception in Streamable HTTP Transport ,Leading to Denial of Service

8.7 CVSS

Vulnerability Description

The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.10.0, if a client deliberately triggers an exception after establishing a streamable HTTP session, this can lead to an uncaught ClosedResourceError on the server side, causing the server to crash and requiring a restart to restore service. Impact may vary depending on the deployment conditions, and presence of infrastructure-level resilience measures. Version 1.10.0 contains a patch for the issue.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-53365

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from modelcontextprotocol

View All →

mcp-server-git has missing path validation when using --repository flag

mcp-server-git argument injection in git_diff and git_checkout functions allows overwriting local files

mcp-server-git's unrestricted git_init tool allows repository creation at arbitrary filesystem locations

DNS Rebinding Protection Disabled by Default in Model Context Protocol Python SDK for Servers Running on Localhost

DNS Rebinding Protection Disabled by Default in Model Context Protocol TypeScript SDK for Servers Running on Localhost

Affected Vendor

modelcontextprotocol

View all reports →

Affected Software

python-sdk

Vulnerable Versions:

< 1.10.0

Timeline

Official Publish: July 4th, 2025

Last Modified: July 8th, 2025

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application

T1203 Exploitation for Client Execution

T1213 Data from Information Repositories

T1499.003 Application Exhaustion Flood