---
id: CVE-2025-53365
aliases:
  - GHSA-j975-95f5-7wqh
  - PYSEC-2026-1618
title: >-
  MCP Python SDK has Unhandled Exception in Streamable HTTP Transport, Leading
  to Denial of Service
summary: >-
  MCP Python SDK has Unhandled Exception in Streamable HTTP Transport, Leading
  to Denial of Service
severity: high
vendor: mcp
product: mcp
ecosystem: pip
affected:
  - mcp < 1.10.0
patched:
  - mcp 1.10.0
published: '2025-07-04'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-j975-95f5-7wqh'
references:
  - url: >-
      https://github.com/modelcontextprotocol/python-sdk/security/advisories/GHSA-j975-95f5-7wqh
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-53365'
  - url: 'https://github.com/modelcontextprotocol/python-sdk/pull/967'
  - url: >-
      https://github.com/modelcontextprotocol/python-sdk/commit/7b420656de48cfdb90b39eb582e60b6d55c2f891
  - url: 'https://github.com/modelcontextprotocol/python-sdk'
  - url: 'https://github.com/modelcontextprotocol/python-sdk/releases/tag/v1.10.0'
tags:
  - osv
  - pip
epss: 0.00367
epssPercentile: 0.30602
ingestedAt: '2026-07-08T18:25:50.638Z'
---

## Overview

If a client deliberately triggers an exception after establishing a streamable HTTP session, this can lead to an uncaught ClosedResourceError on the server side, causing the server to crash and requiring a restart to restore service. Impact may vary depending on the deployment conditions, and presence of infrastructure-level resilience measures.

Thank you to Rich Harang for reporting this issue.

## Affected packages

- `mcp < 1.10.0`

## Remediation

Upgrade to a patched release:

- `mcp 1.10.0`