GHSA-q382-vc8q-7jhj — Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk

Affected: Go: github.com/modelcontextprotocol/go-sdk

The Go SDK recently transitioned to the `segmentio/encoding` library for JSON parsing in version 1.3.1. While this change addressed both case-insensitivity and ASCII folding issues, the new parser implemented aggressive key matching that treated keys with `null` Unicode characters appended at the end as equivalent to their base strings.

#### Impact

When combined with duplicate keys, the described behavior leads to a "last key wins" resolution that could override the intended MCP message. This had the potential for: - **Bypassing intermediary inspection:** Proxies or policy layers that matched on exact field names may have failed to detect or filter these messages. - **Cross-implementation inconsistency:** Other MCP SDKs (TypeScript, Python) use case-sensitive parsing and would reject the same messages, creating potential security-boundary confusion.

#### Fix:

The `segmentio/encoding` package was patched with a fix in https://github.com/segmentio/encoding/commit/7d5a25dbc5da13aed3cb047a127e4d0e96f536fb and a new version of the package was released (`v0.5.4`). The SDK switched to the patched version of the dependency in 724dd47aa. Users are advised to update to v1.4.1 to resolve this issue.

#### Credits: Thank you to Francesco Lacerenza (Doyensec) for reporting this issue.

Most recent entries from all

GHSA-q382-vc8q-7jhj — Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk