Part 67 · Module 9: Production and Ecosystem

Incident: One client's hang-up stopped the server

9 min read·13 Oct 2026

Module 9 · Incident file · About 35 minutes

What happened

The advisory in one line: a client's deliberate hang-up became an uncaught error that crashed the whole server (red); it was rated High (amber) and fixed in 1.10.0 (green).

On 4 July 2025 the maintainers of the MCP Python SDK published advisory GHSA-j975-95f5-7wqh, "MCP Python SDK has Unhandled Exception in Streamable HTTP Transport, Leading to Denial of Service" (GitHub advisory). It was assigned CVE-2025-53365 and rated High, with a CVSS 4.0 score of 8.7: reachable over the network, no privileges and no user interaction needed, and high impact on availability only.

The advisory's description, in full: "If a client deliberately triggers an exception after establishing a streamable HTTP session, this can lead to an uncaught ClosedResourceError on the server side, causing the server to crash and requiring a restart to restore service. Impact may vary depending on the deployment conditions, and presence of infrastructure-level resilience measures." It thanks Rich Harang for the report. Every mcp release before 1.10.0 was affected.

The fix was merged and released (green) before the advisory made the problem public on 4 July 2025 (amber).

The fix came first. Pull request #967, "Fix uncaught exception in MCP server", was opened on 16 June 2025 and merged the next day (PR #967). Release 1.10.0 shipped it on 26 June. The CVE was reserved on 27 June and published with the advisory on 4 July (CVE record). The sources give no count of affected servers and report no attack in the wild; this file claims neither.

What happened

The rest of this course is yours to keep