Rust advisories / crate
Security history · rmcp · data from Oct 24, 2026
Is rmcp safe to use? Its security history
VerdictNo open advisories. 5 past vulnerabilities were fixed; use 1.4.0 or newer to be clear of all of them.
5advisories on record
5vulnerabilities
0unmaintained notices
1.4.0newest fixed version
Every advisory, newest first
- VulnerabilityGHSA-c9xm-49cp-xcr9 · 2026-10-02rmcp OAuth client fetches server-controlled resource_metadata URLs
- VulnerabilityGHSA-9g45-5xwm-f3wc · 2026-09-17RMCP: Custom HTTP headers leak to cross-origin redirect targets
- VulnerabilityGHSA-9pj6-vhgr-3mwh · 2026-09-16RMCP: Unauthenticated permanent session-table leak in rmcp Streamable HTTP server transport leads to remote denial-of-service
- VulnerabilityGHSA-33f5-2c5q-wgwj · 2026-09-16RMCP: Missing Resource Field Validation in OAuth Protected Resource Metadata Discovery
- Vulnerability HighRUSTSEC-2026-0189 · 2026-04-29DNS rebinding vulnerability in rmcp Streamable HTTP server transport
Check your version
Run cargo tree -i rmcp to see which version you build and why, or paste your Cargo.lock into the Cargo.toml checker to match every advisory against your exact versions.
RustSec advisories (CC0-1.0) and GitHub-reviewed advisories via OSV's crates.io export, downloaded Oct 24, 2026.
Up next
Are you affected?Check your whole dependency treeRead it next →Also worth your time
Did this answer your question?