CVE-2026-63128 in rust-sdk
Summary
by MITRE • 09/17/2026
RMCP is an official Rust SDK for the Model Context Protocol. Prior to 2.0.0, the rmcp crate's stateful Streamable HTTP server in crates/rmcp/src/transport/streamable_http_server/tower.rs allows an unauthenticated client to send a well-formed JSON-RPC POST that is not an initialization request, or an initialization request with a mismatched protocol header, causing StreamableHttpService::handle_post to call LocalSessionManager.create_session before validating the message. An early validation failure returns without removing the inserted LocalSessionHandle from LocalSessionManager.sessions, permanently retaining session and channel state for the server process lifetime. Repeated requests can grow the shared session table without bound, degrade legitimate-client latency through lock contention, exhaust memory, and terminate the server. This issue is fixed in version 2.0.0.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 09/17/2026
The vulnerability identified within the RMCP Rust SDK prior to version 2.0.0 represents a critical resource exhaustion flaw rooted in improper session management logic within the Streamable HTTP transport layer. The Model Context Protocol facilitates communication between large language models and various tools, relying on robust state handling for persistent connections. In versions preceding 2.0.0, the implementation of the StreamableHttpService contains a logical error during the initialization phase of client sessions. Specifically, when an unauthenticated or improperly authenticated client sends a well-formed JSON-RPC POST request that is not a valid initialization request, or includes mismatched protocol headers, the server's handling routine proceeds to create and register a new LocalSessionHandle within the shared LocalSessionManager before performing necessary validation checks on the message content. This inversion of operations means that session resources are allocated and retained in memory even when the subsequent validation fails and the connection is ultimately rejected.
This architectural flaw leads directly to an unbounded resource consumption scenario, commonly categorized under CWE-770: Allocation of Resources Without Limits or Throttling. Because each failed initialization attempt results in a permanently retained entry in the server's shared session table, attackers can exploit this by sending a high volume of malformed requests from multiple sources or via persistent connections. The LocalSessionManager employs locking mechanisms to protect its internal state, and as the number of invalid sessions grows, lock contention increases significantly for all legitimate operations. This degradation affects the latency experienced by valid clients attempting to establish proper connections or exchange data, effectively creating a denial-of-service condition through performance degradation rather than just outright termination.
The operational impact extends beyond simple memory exhaustion. As the shared session table expands without bound, it consumes increasing amounts of heap memory within the Rust process. Eventually, this leads to out-of-memory conditions that cause the server application to crash or be terminated by the operating system's kernel oom-killer. This results in a complete service outage for all users relying on the Model Context Protocol infrastructure. The vulnerability is particularly severe because it requires no authentication, allowing any network-accessible client to trigger the condition. From an offensive security perspective, this aligns with MITRE ATT&CK technique T1496: Resource Hijacking, where adversaries consume computational resources to disrupt service availability or degrade performance for legitimate users.
To mitigate this vulnerability and prevent similar issues in future implementations, it is essential to enforce strict validation ordering within the request handling pipeline. The server must validate the protocol headers and message structure before allocating any persistent session state or acquiring locks on shared managers. Implementing rate limiting at the transport layer can also help dampen the impact of volumetric attacks while proper fixes are deployed. Organizations using RMCP versions prior to 2.0.0 should upgrade immediately to version 2.0.0, where this logic has been corrected to ensure that session resources are only allocated upon successful validation of the initialization request. Additionally, implementing monitoring for rapid spikes in failed connection attempts can provide early warning indicators of exploitation activity targeting this specific flaw.