6.1Media
CVE-2026-34237MCP Java SDK has a Hardcoded Wildcard CORS (Access-Control-Allow-Origin: *)
Descripción
MCP Java SDK is the official Java SDK for Model Context Protocol servers and clients. Prior to versions 0.83.0, 1.0.1, and 1.1.1, there is a hardcoded wildcard CORS vulnerability. This issue has been patched in versions 0.83.0, 1.0.1, and 1.1.1.
Debilidad (CWE):
CWE-942
Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.
Productos y versiones afectados
| Fabricante | Producto | Versiones | |
|---|---|---|---|
| lfprojects | mcp java sdk | < 1.0.1 | |
| modelcontextprotocol | java-sdk | >= 1.0.0, < 1.0.1, >= 1.1.0, < 1.1.1, < 0.18.3 |
Referencias y parches
- https://github.com/modelcontextprotocol/java-sdk/security/advisories/GHSA-hv2w-8mjj-jw22 MitigationVendor Advisory
- https://github.com/modelcontextprotocol/java-sdk/blob/main/mcp-core/src/main/java/io/modelcontextprotocol/ser… Patch
- https://github.com/modelcontextprotocol/java-sdk/blob/main/mcp-core/src/main/java/io/modelcontextprotocol/ser… Patch
Coincidencias CPE (NVD) (2)
cpe:2.3:a:lfprojects:mcp_java_sdk:*:*:*:*:*:*:*:*< 1.0.1cpe:2.3:a:lfprojects:mcp_java_sdk:1.1.0:*:*:*:*:*:*:*