Vulnerability in Modelcontextprotocol Python-Sdk

CVE-2025-53366

The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.9.4, a validation error in the MCP SDK can cause an unhandled exception when processing malformed requests, resulting in service unavailability (500 errors) until manually restarted. Impact may vary depending on the deployment conditions, and presence of infrastructure-level resilience measures. Version 1.9.4 contains a patch for the issue.

Published · last modified .

EPSS exploit prediction

EPSS: 0.093 (95.3th percentile), scored .

Low probability of exploitation in the next 30 days, but still tracked. 95th percentile — 95.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS trend (30 days)EPSS over the last 30 days for CVE-2025-53366: rose from 0.073 to 0.093.

EPSS over last 30 days · oldest: 0.073 · newest: 0.093 · change: +0.020

Affected products

Weakness classification (CWE)

References