CVE mentions, exploit signals, and PoC evidence in one fast public view.
Vendor/product archive
3 CVEs tagged to lfprojects / mcp_go_sdk — 0 Critical, 3 High, 0 Medium, 0 Low, 0 Unrated.
The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.0, the Model Context Protocol (MCP) Go SDK does not enable DNS rebinding protection by default for HTTP-based…
The Go MCP SDK used Go's standard encoding/json. Prior to version 1.4.1, the Go SDK's Streamable HTTP transport accepted browser-generated cross-site `POST` requests without valid…
The Go MCP SDK used Go's standard encoding/json.Unmarshal for JSON-RPC and MCP protocol message parsing in versions prior to 1.3.1. Go's standard library performs case-insensitive…