CVE-2025-53365: MCP Python SDK DoS Vulnerability

CVE-2025-53365 Overview

A denial of service vulnerability exists in the MCP Python SDK (mcp package on PyPI), which is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.10.0, if a client deliberately triggers an exception after establishing a streamable HTTP session, this can lead to an uncaught ClosedResourceError on the server side, causing the server to crash and requiring a restart to restore service.

Critical Impact
This vulnerability allows unauthenticated remote attackers to crash MCP Python SDK servers by exploiting improper exception handling, resulting in service disruption that requires manual intervention to restore.

Affected Products

MCP Python SDK (mcp on PyPI) versions prior to 1.10.0

Discovery Timeline

2025-07-04 - CVE CVE-2025-53365 published to NVD
2025-07-08 - Last updated in NVD database

Technical Details for CVE-2025-53365

Vulnerability Analysis

This vulnerability is classified as CWE-248 (Uncaught Exception), which occurs when an exception is not properly caught or handled by the application. In the context of the MCP Python SDK, when a client establishes a streamable HTTP session and then deliberately triggers an exception (such as by abruptly closing the connection or sending malformed data), the server-side code fails to properly handle the resulting ClosedResourceError exception.

The impact of this vulnerability depends on deployment conditions and the presence of infrastructure-level resilience measures such as process supervisors, container orchestration restart policies, or load balancer health checks. In environments without such protections, successful exploitation results in complete service unavailability until manual restart.

Root Cause

The root cause lies in insufficient exception handling within the streamable HTTP session management code. When a client connection is terminated unexpectedly or an exception is deliberately triggered, the ClosedResourceError exception propagates uncaught through the call stack, resulting in an unhandled exception that terminates the server process. This represents a failure to implement defensive programming practices around resource lifecycle management.

Attack Vector

The attack can be executed remotely over the network without requiring authentication or user interaction. An attacker needs only to:

Establish a streamable HTTP session with the vulnerable MCP Python SDK server
Deliberately trigger a connection closure or exception condition
The server fails to catch the resulting ClosedResourceError, causing a crash

The attack is straightforward to execute and can be repeated to maintain a persistent denial of service condition. The vulnerability affects the availability of the service but does not impact confidentiality or integrity of data.

Detection Methods for CVE-2025-53365

Indicators of Compromise

Unexpected server process terminations in MCP Python SDK deployments
ClosedResourceError exceptions appearing in server logs immediately before crashes
Repeated HTTP session establishments from the same source IP followed by abrupt disconnections
Service unavailability patterns correlating with specific client connection events

Detection Strategies

Monitor application logs for uncaught ClosedResourceError exceptions in MCP SDK components
Implement anomaly detection for unusual patterns of HTTP session establishment and termination
Track server process uptime metrics and alert on unexpected restarts
Deploy network-level monitoring for connection patterns indicative of deliberate exception triggering

Monitoring Recommendations

Configure centralized logging to capture Python exception tracebacks from MCP SDK servers
Set up process monitoring with alerts for unexpected terminations of MCP SDK server processes
Implement connection rate limiting and monitoring at the network or application layer
Enable infrastructure-level health checks to detect and respond to service unavailability

How to Mitigate CVE-2025-53365

Immediate Actions Required

Upgrade the MCP Python SDK to version 1.10.0 or later immediately
Review deployment configurations to ensure process supervisors or container restart policies are in place
Implement rate limiting on incoming connections to reduce the impact of repeated exploitation attempts
Consider deploying behind a reverse proxy with connection management capabilities

Patch Information

The vulnerability has been patched in MCP Python SDK version 1.10.0. The fix addresses the uncaught exception handling by properly catching and handling ClosedResourceError exceptions that occur during streamable HTTP session management.

For technical details on the patch, refer to the following resources:

Workarounds

Deploy MCP SDK servers behind process supervisors (e.g., systemd, supervisord) configured to automatically restart on failure
Use container orchestration platforms with restart policies to minimize downtime from crashes
Implement network-level protections such as connection rate limiting and timeout enforcement
Consider deploying multiple server instances behind a load balancer to maintain availability during individual instance failures

bash

# Example: Upgrade MCP Python SDK to patched version
pip install --upgrade mcp>=1.10.0

# Verify installed version
pip show mcp | grep Version