{"vulnerability": "cve-2026-6312", "sightings": [{"uuid": "f04a3421-425c-4064-8847-6bbdb1954f64", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-6312", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/google-chrome-multiple-vulnerabilities_20260416", "content": "", "creation_timestamp": "2026-04-15T18:00:00.000000Z"}, {"uuid": "99fc5aab-dea2-4898-b6a1-38b84e3145c6", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-6312", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/microsoft-edge-multiple-vulnerabilities_20260420", "content": "", "creation_timestamp": "2026-04-19T20:00:00.000000Z"}, {"uuid": "be38a298-b824-45ba-82ec-591c5d6a4462", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-6312", "type": "seen", "source": "https://www.hkcert.org/security-bulletin/chromeos-multiple-vulnerabilities_20260428", "content": "", "creation_timestamp": "2026-04-27T20:00:00.000000Z"}, {"uuid": "2a904e9e-b9d6-4352-a548-6f6c96b0d60e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63125", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtmjasjgmn2c", "content": "CVE-2026-63125 - incus\nA security issue affects incus (Debian). The advisory does not describe the issue in detail. Check the linked advisory for the fixed version and details.\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#incus #debian #Debian13 #CVE #infosec", "creation_timestamp": "2026-08-21T19:40:04.339864Z"}, {"uuid": "b46fd48b-7e88-4ab6-baee-715eb7ad1d27", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63125", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mtoa2wjvmr27", "content": "\ud83d\udd34 CVE-2026-63125 - Critical (9.9)\n\nIncus is a system container and virtual machine manager. Prior to version 7.3.0, an unprivileged,...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-63125/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-08-22T12:01:03.977199Z"}, {"uuid": "8fdcf896-8671-421f-8457-eb0b1cfa8b47", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63125", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mtmtcnymuu2p", "content": "CVE-2026-63125 - incus\nIncus, a tool for running containers and virtual machines, allows a user without admin rights who can create images or instances to execute any code with full system privileges on the host.\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#incus #lxc #CVE #infosec", "creation_timestamp": "2026-08-21T22:40:05.231541Z"}, {"uuid": "4507fefb-7805-4087-b05d-445c9ebccec0", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-63123", "type": "published-proof-of-concept", "source": "https://github.com/tinacms/tinacms/security/advisories/GHSA-rgr9-r7mj-mf6x", "content": "", "creation_timestamp": "2026-08-19T22:35:02.891896Z"}, {"uuid": "2fe8786e-6059-4114-a900-8fc9f9691d2d", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-63124", "type": "published-proof-of-concept", "source": "https://github.com/netty/netty-incubator-codec-ohttp/security/advisories/GHSA-8cfx-wx3q-mh5q", "content": "", "creation_timestamp": "2026-08-20T20:35:06.253875Z"}, {"uuid": "fbf0981f-3202-455d-9f6f-69e1ed43273e", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63125", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mtm5hwzd6q2e", "content": "\ud83d\udea8 CVE-2026-63125 \u2014 CVSS 9.9 CRITICAL\n\nIncus is a system container and virtual machine manager. Prior to version 7.3.0, an unprivileged, project-c...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-63125\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-08-21T16:09:18.854587Z"}, {"uuid": "89a5dd7d-3333-4138-9090-dd39be9d6ab9", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63125", "type": "seen", "source": "https://bsky.app/profile/hugovalters.bsky.social/post/3mtmdujupza2o", "content": "CVE-2026-63125 \u2013 Critical RCE/privesc in Incus. Unprivileged user can execute code as root via symlink attack. CVSS 9.9. Patch to 7.3.0 immediately. #CVE #Incus #infosec\n\nhttps://www.valtersit.com/cve/CVE-2026-63125/", "creation_timestamp": "2026-08-21T18:03:43.958673Z"}, {"uuid": "8f04faca-8a70-41cc-b314-da7a503e4612", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63125", "type": "seen", "source": "https://mastodon.social/users/hugovalters/statuses/117134814377627124", "content": "CVE-2026-63125 \u2013 Critical RCE/privesc in Incus. Unprivileged user can execute code as root via symlink attack. CVSS 9.9. Patch to 7.3.0 immediately. #CVE #Incus #infosec\nhttps://www.valtersit.com/cve/CVE-2026-63125/", "creation_timestamp": "2026-08-21T18:03:48.506011Z"}, {"uuid": "a927ef78-cb1a-4750-b854-42120c02bd44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63124", "type": "seen", "source": "https://bsky.app/profile/thestandup.bsky.social/post/3mtkgttee5z2v", "content": "Netty's incubator Binary HTTP codec (CVE-2026-63124): BinaryHttpParser enters a non-terminating loop when a known-length field section ends exactly after a complete field line. Unauthenticated, and a tiny malformed request or response keeps the parsing thread busy indefinitely. #dev", "creation_timestamp": "2026-08-20T23:51:42.579118Z"}, {"uuid": "593a63e3-cc54-4c19-9d51-f96a8d9e7902", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-63128", "type": "published-proof-of-concept", "source": "https://github.com/modelcontextprotocol/rust-sdk/security/advisories/GHSA-9pj6-vhgr-3mwh", "content": "", "creation_timestamp": "2026-09-17T00:35:06.758824Z"}, {"uuid": "dd1cb391-ccce-4ec6-845c-427864bfe858", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-63127", "type": "published-proof-of-concept", "source": "https://github.com/modelcontextprotocol/rust-sdk/security/advisories/GHSA-33f5-2c5q-wgwj", "content": "", "creation_timestamp": "2026-09-17T00:35:09.126898Z"}, {"uuid": "f36309e8-b17f-4ada-82c1-05ffee1681ab", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63128", "type": "seen", "source": "https://gist.github.com/alon710/db9fb10afa43797b42605078feda688f", "content": "# CVE-2026-63128: CVE-2026-63128: Uncontrolled Resource Consumption in Model Context Protocol Rust SDK (rmcp)\n\n> **CVSS Score:** 7.5\n> **Published:** 2026-09-16\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63128\n\n## Summary\nCVE-2026-63128 is a high-severity uncontrolled resource consumption vulnerability in the Model Context Protocol (MCP) official Rust SDK (the rmcp crate) prior to version 2.0.0. An unauthenticated attacker can exploit this vulnerability by sending malformed or mismatching handshake requests to the stateful Streamable HTTP server, causing persistent memory allocation without cleanup. This results in an unbounded memory leak and lock contention that ultimately leads to complete denial of service.\n\n## TL;DR\nThe stateful HTTP server in the rmcp crate allocates session resources before validating request headers and bodies. If validation fails, the server exits early without reclaiming the allocated memory, leading to an unbounded memory leak and eventual server crash.\n\n## Technical Details\n\n- **CWE ID**: CWE-400 / CWE-401 / CWE-772\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 7.5 (High)\n- **Exploit Status**: None\n- **CISA KEV Listed**: No\n- **Mitigated Version**: 2.0.0\n\n## Affected Systems\n\n- Model Context Protocol Rust SDK (rmcp crate) prior to version 2.0.0\n- **rmcp**: < 2.0.0 (Fixed in: `2.0.0`)\n\n## Mitigation\n\n- Upgrade the rmcp crate to version 2.0.0 or higher.\n- Implement rate-limiting on stateful Streamable HTTP POST endpoints.\n- Deploy WAF rules to validate MCP header protocol integrity before forwarding requests to the application layer.\n\n**Remediation Steps:**\n1. Identify dependencies on the 'rmcp' crate within Cargo.toml.\n2. Update the dependency version to '2.0.0' or higher.\n3. Verify integration tests pass under stateful configurations.\n4. Deploy the updated application container or binary to production environments.\n\n## References\n\n- [Official GitHub Advisory](https://github.com/modelcontextprotocol/rust-sdk/security/advisories/GHSA-9pj6-vhgr-3mwh)\n- [Fix PR #934](https://github.com/modelcontextprotocol/rust-sdk/pull/934)\n- [Fix Commit dfa7fd6f9309deab60bea230b041be9a3fcda846](https://github.com/modelcontextprotocol/rust-sdk/commit/dfa7fd6f9309deab60bea230b041be9a3fcda846)\n- [SDK Release v2.0.0](https://github.com/modelcontextprotocol/rust-sdk/releases/tag/rmcp-v2.0.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63128) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-17T02:31:48.259144Z"}, {"uuid": "d1d2c85a-cb7b-4d13-9941-43c8a2098339", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-63127", "type": "seen", "source": "https://gist.github.com/alon710/16597bd55d59e6c89394c487c227381c", "content": "# CVE-2026-63127: CVE-2026-63127: OAuth Resource Spoofing and Token Leakage in rmcp SDK\n\n> **CVSS Score:** 8.2\n> **Published:** 2026-09-16\n> **Full Report:** https://cvereports.com/reports/CVE-2026-63127\n\n## Summary\nAn OAuth resource spoofing vulnerability in the rmcp crate prior to 2.0.0 allows a malicious Model Context Protocol (MCP) server to spoof protected resource metadata. By presenting metadata pointing to a legitimate resource and authorization server, the attacker can trick the client into completing the authentication flow and subsequently sending the authorized token back to the malicious server.\n\n## TL;DR\nA missing validation of the RFC 9728 'resource' field in the rmcp crate allows rogue MCP servers to perform OAuth resource spoofing and capture legitimate access tokens.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-345\n- **Attack Vector**: Network (AV:N)\n- **CVSS v3.1 Score**: 8.2 (High)\n- **EPSS Score**: N/A\n- **Impact**: Confidentiality High (C:H), Integrity Low (I:L), Scope Changed (S:C)\n- **Exploit Status**: Proof-of-Concept (PoC) available in official test suite\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- Model Context Protocol (MCP) clients using the rmcp crate with OAuth features enabled\n- **rmcp**: < 2.0.0 (Fixed in: `2.0.0`)\n\n## Mitigation\n\n- Upgrade the rmcp crate to version 2.0.0 or higher.\n- Disable dynamic OAuth metadata discovery if interacting with untrusted or unverified third-party MCP servers.\n- Enforce egress network controls to restrict outbound metadata discovery requests to trusted hosts only.\n\n**Remediation Steps:**\n1. Open the Cargo.toml of your Rust project containing the rmcp dependency.\n2. Update the dependency entry to: rmcp = { version = \">= 2.0.0\", features = [\"auth\"] }.\n3. Run `cargo update -p rmcp` to update the Cargo.lock file to the patched version.\n4. Verify the updated configuration by rebuilding your client and executing automated verification tests.\n\n## References\n\n- [GHSA-33f5-2c5q-wgwj: OAuth Resource Spoofing Vulnerability in rmcp Crate](https://github.com/modelcontextprotocol/rust-sdk/security/advisories/GHSA-33f5-2c5q-wgwj)\n- [Pull Request #937](https://github.com/modelcontextprotocol/rust-sdk/pull/937)\n- [Fix Commit](https://github.com/modelcontextprotocol/rust-sdk/commit/c1a8b29ff2cc45e7820b900dae42cbb4958089ec)\n- [Release rmcp-v2.0.0](https://github.com/modelcontextprotocol/rust-sdk/releases/tag/rmcp-v2.0.0)\n- [CVE-2026-63127 NVD Record](https://www.cve.org/CVERecord?id=CVE-2026-63127)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-63127) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-17T03:31:23.748728Z"}, {"uuid": "be61630f-3a7a-428f-83dc-4e023574802b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-63126", "type": "published-proof-of-concept", "source": "https://github.com/square/wire/security/advisories/GHSA-9rm7-3qhh-h2mc", "content": "", "creation_timestamp": "2026-09-17T16:35:08.741740Z"}]}