[DaleSeo]

Affected crate(s)

• rmcp (45,192,055 total downloads; 25,999,423 recent downloads per crates.io)

Links to upstream issue(s) or PR(s)

• GitHub Security Advisory: GHSA-c9f9-cp8h-jcj5
• Fix commit: modelcontextprotocol/rust-sdk@3e0156c

Severity

Medium. A malicious or compromised MCP server can make an rmcp client buffer an unbounded response body and run out of memory, during initialize and before any authentication. On desktop or agent hosts this terminates the whole host application. The upstream GHSA uses CVSS 3.1 score 6.5.

Checklist

• Advisory filename(s) starts with RUSTSEC-0000-0000 as the ID
• date field is set to the public disclosure date
• Contains a concise and descriptive title after advisory metadata
• Asked maintainer(s) if publishing an advisory is appropriate (filed by an rmcp maintainer)

Testing

• Added the advisory under crates/rmcp/RUSTSEC-0000-0000.md using the RustSec template.
• rustsec-admin lint passes.