go-sdk vulnerabilities

CVEs whose affected-version data names the go-sdk package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-27896High· 7.0

6mo ago

MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity

The Go MCP SDK used Go's standard encoding/json.Unmarshal for JSON-RPC and MCP protocol message parsing in versions prior to 1.3.1. Go's standard library performs case-insensitive matching of JSON keys to struct field tags — a field tagg…

▾ Twilightmodelcontextprotocol · go-sdkEPSS 0.26%via CVEORG