GHSA-wvj2-96wp-fq3f CVE-2026-27896 GO-2026-4569
MCP Go SDK Vulnerable to Improper Handling of Case Sensitivity
- Severity
- 7.0 / 10
- High · CVSS 4.0
- Exploit chance (EPSS)
- 0.29%
- Chance of exploitation in the next 30 days. Higher than 21.83% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Fix
1.3.1- Upgrade github.com/modelcontextprotocol/go-sdk to this version or later
Description
The Go MCP SDK used Go's standard encoding/json.Unmarshal for JSON-RPC and MCP protocol message parsing. Go's standard library performs case-insensitive matching of JSON keys to struct field tags — a field tagged json:"method" would also match "Method", "METHOD", etc. Additionally, Go's standard library folds the Unicode characters ſ (U+017F) and K (U+212A) to their ASCII equivalents s and k, meaning fields like "paramſ" would match "params". This violated the JSON-RPC 2.0 specification, which defines exact field names.
Impact:
A malicious MCP peer may have been able to send protocol messages with non-standard field casing (e.g., "Method" instead of "method") that the SDK would silently accept. This had the potential for:
- Bypassing intermediary inspection: Proxies or policy layers that matched on exact field names may have failed to detect or filter these messages.
- Cross-implementation inconsistency: Other MCP SDKs (TypeScript, Python) use case-sensitive parsing and would reject the same messages, creating potential security-boundary confusion.
Fix:
Go's standard JSON unmarshaling was replaced with a case-sensitive decoder (github.com/segmentio/encoding) in commit 7b8d81c. Users are advised to update to v1.3.1 to resolve this issue.
Credits:
MCP Go SDK thanks Francesco Lacerenza (Doyensec) for reporting this issue.
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| github.com/modelcontextprotocol/go-sdk | < 1.3.1 |
1.3.1 |
| github.com/modelcontextprotocol/go-sdk | < 1.3.1 |
1.3.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
github.com/modelcontextprotocol/go-sdk Go → 1.3.1
- go
go get github.com/modelcontextprotocol/go-sdk@v1.3.1 && go mod tidy
Severity breakdown
CVSS 4.0 7.0
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- Present
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- None
- Integrity (vulnerable system)
- None
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- High
- Integrity (subsequent systems)
- High
- Availability (subsequent systems)
- None
CVSS 3.1 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Weakness
CWE-178: Improper Handling of Case Sensitivity
The product does not properly account for differences in case sensitivity when accessing or determining the properties of a resource, leading to inconsistent results.
How to prevent it
- Architecture and Design: Avoid making decisions based on names of resources (e.g. files) if those resources can have alternate names.
- Implementation: Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- Implementation: Inputs should be decoded and canonicalized to the application's current internal representation before being validated (CWE-180). Make sure that the application does not decode the same input twice (CWE-174). Such errors could be used to bypass allowlist validation schemes by introducing dangerous inputs after they have been checked.
CWE-436: Interpretation Conflict
Product A handles inputs or steps differently than Product B, which causes A to perform incorrect actions based on its perception of B's state.
References
Advisories
Fixes and patches
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-xw59-hvm2-8pj6 DNS Rebinding Protection Disabled by Default in Model Context Protocol Go SDK for Servers Running on Localhost | High | Also affects github.com/modelcontextprotocol/go-sdk |
| GHSA-89xv-2j6f-qhc8 Cross-Site Tool Execution for HTTP Servers without Authorizatrion in github.com/modelcontextprotocol/go-sdk | Medium | Also affects github.com/modelcontextprotocol/go-sdk |
| GHSA-q382-vc8q-7jhj Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk | High | Also affects github.com/modelcontextprotocol/go-sdk |
| GHSA-vjh5-4x84-xrqp Nuxt: Server-side route rules (`redirect`, `headers`, `proxy`, `ssr`) are skipped for case-variant paths when routing is case-insensitive | Medium | Same weakness, CWE-178 |
| GHSA-f72v-6w45-q472 undici vulnerable to Subresource Integrity bypass via non-lowercase algorithm tokens | High | Same weakness, CWE-178 |
| GHSA-389g-gv7q-r4x8 fastify is vulnerable to header validation bypass via case-sensitive propertyNames | Low | Same weakness, CWE-178 |
| GHSA-hmp2-4m7g-22cv Backstage: Scaffolder action input authorization bypass | High | Same weakness, CWE-178 |
| GHSA-hrr3-gc8f-f4qj fast-uri vulnerable to inconsistent host case normalization via percent-encoded octets | Medium | Same weakness, CWE-178 |
Credits: anaximand3r
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor