Home
Home
Trends
Trends
Vulnerabilities
Vulnerabilities
News
News
Researchers
Researchers
Why dbugs?
Why dbugs?
Settings

Legitu1337

#38937of 60,391
7.7Total CVSS
Vulnerabilities · 1
PT-2026-120151
2026-10-20
7.7
CVE-2026-111770
Npm
@Modelcontextprotocol/Server
An MCP server accessed over HTTP may deliver responses and notifications from one client to another. This occurs when clients share a single stateless transport, `McpServer` instance, or `Server` instance. The issue stems from messages being matched to a connection using only the JSON-RPC `id`. Since SDK clients typically start numbering requests from 0, these identifiers collide during normal operation.