CVE-2026-116686

A flaw was found in mcp. Client sessions validate server-declared schema documents using a default resolver that automatically retrieves external network and local filesystem references. A malicious server can exploit this flaw to cause a Denial of Service DoS by stalling client sessions...