Bug 2376486 (CVE-2025-53365) - CVE-2025-53365 mcp: MCP Server Crash via ClosedResourceError
Summary: CVE-2025-53365 mcp: MCP Server Crash via ClosedResourceError
Keywords:
Status: NEW
Alias: CVE-2025-53365
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-07-04 23:01 UTC by OSIDB Bzimport
Modified: 2025-07-07 13:34 UTC (History)
11 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2025-07-04 23:01:22 UTC 
The MCP Python SDK, called `mcp` on PyPI, is a Python implementation of the Model Context Protocol (MCP). Prior to version 1.10.0, if a client deliberately triggers an exception after establishing a streamable HTTP session, this can lead to an uncaught ClosedResourceError on the server side, causing the server to crash and requiring a restart to restore service. Impact may vary depending on the deployment conditions, and presence of infrastructure-level resilience measures. Version 1.10.0 contains a patch for the issue.
Note You need to log in before you can comment on or make changes to this bug.