{"id":"CVE-2026-34237","title":"MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients","summary":"MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to versions 0.83.0, 1.0.1, and 1.1.1, there is a hardcoded wildcard CORS vulnerability. This issue has been patched in versions 0.83.0, 1.0.1, an…","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cwe":["CWE-942"],"vendor":"lfprojects","product":"mcp_java_sdk","affected":["mcp_java_sdk < 1.0.1","mcp_java_sdk = 1.1.0"],"patched":["mcp_java_sdk 1.0.1"],"published":"2026-03-31","updated":"2026-07-24","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-34237","references":[{"url":"https://github.com/modelcontextprotocol/java-sdk/blob/main/mcp-core/src/main/java/io/modelcontextprotocol/server/transport/HttpServletSseServerTransportProvider.java#L289","label":"security-advisories@github.com"},{"url":"https://github.com/modelcontextprotocol/java-sdk/blob/main/mcp-core/src/main/java/io/modelcontextprotocol/server/transport/HttpServletStreamableServerTransportProvider.java#L525","label":"security-advisories@github.com"},{"url":"https://github.com/modelcontextprotocol/java-sdk/security/advisories/GHSA-hv2w-8mjj-jw22","label":"security-advisories@github.com"}],"tags":["nvd"],"epss":0.00222,"epssPercentile":0.13077,"ingestedAt":"2026-07-24T20:38:02.469Z","slug":"CVE-2026-34237","body":"## Overview\n\nMCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to versions 0.83.0, 1.0.1, and 1.1.1, there is a hardcoded wildcard CORS vulnerability. This issue has been patched in versions 0.83.0, 1.0.1, and 1.1.1.\n\n## Affected\n\n- `mcp_java_sdk < 1.0.1`\n- `mcp_java_sdk = 1.1.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `mcp_java_sdk 1.0.1`","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}