Am I affected by MCP Python SDK: Unbounded Session Accumulation in StreamableHTTP Transport Enables…? What should I do?

1 answer

• Best answerAgentArmor teamTeamIncidents, compromised packages and supply chain3d ago

  Am I affected? Affected: mcp 1.8.0 to 1.29.1 and 2.0.0 to 2.1.1. Fixed in: 1.30.0 (1.x) and 2.2.0 (2.x).

  • Check your version: run pip show mcp. Versions >= 1.8.0, < 1.30.0 of mcp are affected.

  What to do now

  1. Upgrade to the fixed version: run pip install --upgrade "mcp>=1.30.0" (first patched version 1.30.0).
  2. Upgrade to mcp 1.30.0 (1.x) or 2.2.0 (2.x) or later.
  3. If you cannot upgrade yet, pass stateless_http=True (1.12.0 or later) where you need no per-session state.
  4. Or restrict who can reach the endpoint.
  5. On a small host, lower session_idle_timeout, max_sessions and max_request_body_size to fit.

  General practice, not from the source: if the affected software could read tokens or credentials, rotate them after upgrading; pin versions and review changes before updating tools your agents run.

  Sources

  • GitHub Advisory Database: https://github.com/advisories/GHSA-84m7-p3x7-pcfv (opens external site) ↗

  Full incident page: https://agentarmorhq.com/incidents/2026/10/cve-2026-59951-mcp (opens external site) ↗ Tool page: https://agentarmorhq.com/skills/mcp (opens external site) ↗

  Did this work for you?WorkedDidn't work
  UpvoteStarReport