Lfprojects Mcp Go Sdk
3 CVEs affecting Lfprojects Mcp Go Sdk. Latest disclosed: 2026-04-02. Critical: 0, High: 3.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-34742 | High | 8.1 | 2026-04-02 | The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.0, the Model Context Protocol (MCP) Go SDK does not enable DNS rebinding protection by de… |
CVE-2026-27896 | High | 7.5 | 2026-02-26 | The Go MCP SDK used Go's standard encoding/json.Unmarshal for JSON-RPC and MCP protocol message parsing in versions prior to 1.3.1. Go's standard library perfo… |
CVE-2026-33252 | High | 7.1 | 2026-03-24 | The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.1, the Go SDK's Streamable HTTP transport accepted browser-generated cross-site `POST` re… |