Tracking: CVE-2026-63128
Severity: High
Who is affected
The Rust RMCP SDK before 2.0.0 when used for a stateful Streamable HTTP server. An unauthenticated attacker must be able to reach the affected listener.
How the attack works
The server creates a session before completing request validation. Certain invalid pre-initialization requests, including inappropriate messages or protocol headers, return early without removing the retained LocalSessionHandle and associated channels.
Repeated requests grow the session table and memory usage. Lock contention can also increase latency before the process eventually fails. Because each request can leave retained state, low-cost invalid traffic can have a lasting effect beyond its response.
What to do
- Upgrade to 2.0.0 or later, then restart affected processes to discard accumulated state.
- Restrict the Streamable HTTP endpoint and apply request-rate limits while patching.
- Review invalid initialization traffic, unexplained session growth, memory use, and latency. Confirm that rejected requests no longer leave retained sessions after remediation.
Scope and limits
The affected scope is the stateful HTTP implementation. Do not assume the same session-retention path exists in every RMCP transport.