[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fzKIHB45wlIpFpM-RtqZnIVj78IT4bT6uAnJt4dFTeVo":3,"g5a-risk:CVE-2026-34742":149},{"success":4,"data":5,"meta":146},true,{"cveId":6,"title":7,"description":8,"shortDescription":9,"publishedDate":10,"lastModified":11,"cvssScore":12,"cvssVector":13,"cvssMetrics":14,"epssScore":51,"epssPercentile":29,"epssTimeSeries":52,"severity":53,"affectedProducts":54,"affectedProductsCount":60,"references":61,"referencesCount":38,"weaknesses":92,"weaknessesCount":60,"isActivelyExploited":101,"cisaInfo":29,"otxData":29,"relatedBlogPosts":102,"seoMetadata":103,"configurations":128,"relatedVendorCves":137,"notableEvents":138},"CVE-2026-34742","What is CVE-2026-34742?","The Go MCP SDK used Go's standard encoding\u002Fjson. Prior to version 1.4.0, the Model Context Protocol (MCP) Go SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication with StreamableHTTPHandler or SSEHandler, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or access resources exposed by the MCP server on behalf of the user in those limited circumstances. This issue has been patched in version 1.4.0.","The Go MCP SDK used Go's standard encoding\u002Fjson. Prior to version 1.4.0, the Model Context Protocol (MCP) Go SDK does not enable DNS rebinding protection by ...","2026-04-02T19:21:33.023","2026-07-24T21:10:00.143",7.6,"CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:P\u002FPR:N\u002FUI:P\u002FVC:H\u002FVI:H\u002FVA:N\u002FSC:N\u002FSI:N\u002FSA:N\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",{"CVSSMetricV31":15,"CVSSMetricV30":41,"CVSSMetricV2":42,"CVSSMetricV40":43},[16,32],{"Source":17,"Type":18,"CVSSData":19,"ExploitabilityScore":30,"ImpactScore":31},"nvd@nist.gov","Primary",{"Version":20,"VectorString":21,"AttackVector":22,"AttackComplexity":23,"PrivilegesRequired":24,"UserInteraction":25,"Scope":26,"ConfidentialityImpact":27,"IntegrityImpact":27,"AvailabilityImpact":24,"BaseScore":28,"BaseSeverity":27,"ExploitCodeMaturity":29,"RemediationLevel":29,"ReportConfidence":29,"TemporalScore":29,"TemporalSeverity":29,"ConfidentialityRequirement":29,"IntegrityRequirement":29,"AvailabilityRequirement":29,"ModifiedAttackVector":29,"ModifiedAttackComplexity":29,"ModifiedPrivilegesRequired":29,"ModifiedUserInteraction":29,"ModifiedScope":29,"ModifiedConfidentialityImpact":29,"ModifiedIntegrityImpact":29,"ModifiedAvailabilityImpact":29,"EnvironmentalScore":29,"EnvironmentalSeverity":29},"3.1","CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:R\u002FS:U\u002FC:H\u002FI:H\u002FA:N","NETWORK","LOW","NONE","REQUIRED","UNCHANGED","HIGH",8.1,null,2.8,5.2,{"Source":33,"Type":34,"CVSSData":35,"ExploitabilityScore":39,"ImpactScore":40},"0b0ca135-0b70-47e7-9f44-1890c2a1c46c","Secondary",{"Version":20,"VectorString":36,"AttackVector":22,"AttackComplexity":27,"PrivilegesRequired":24,"UserInteraction":25,"Scope":37,"ConfidentialityImpact":27,"IntegrityImpact":27,"AvailabilityImpact":24,"BaseScore":38,"BaseSeverity":27,"ExploitCodeMaturity":29,"RemediationLevel":29,"ReportConfidence":29,"TemporalScore":29,"TemporalSeverity":29,"ConfidentialityRequirement":29,"IntegrityRequirement":29,"AvailabilityRequirement":29,"ModifiedAttackVector":29,"ModifiedAttackComplexity":29,"ModifiedPrivilegesRequired":29,"ModifiedUserInteraction":29,"ModifiedScope":29,"ModifiedConfidentialityImpact":29,"ModifiedIntegrityImpact":29,"ModifiedAvailabilityImpact":29,"EnvironmentalScore":29,"EnvironmentalSeverity":29},"CVSS:3.1\u002FAV:N\u002FAC:H\u002FPR:N\u002FUI:R\u002FS:C\u002FC:H\u002FI:H\u002FA:N","CHANGED",8,1.6,5.8,[],[],[44],{"Source":45,"Type":34,"CVSSData":46},"security-advisories@github.com",{"Version":47,"VectorString":13,"BaseScore":12,"BaseSeverity":27,"AttackVector":22,"AttackComplexity":23,"AttackRequirements":48,"PrivilegesRequired":24,"UserInteraction":49,"VulnConfidentialityImpact":27,"VulnIntegrityImpact":27,"VulnAvailabilityImpact":24,"SubConfidentialityImpact":24,"SubIntegrityImpact":24,"SubAvailabilityImpact":24,"ExploitMaturity":50,"ConfidentialityRequirement":50,"IntegrityRequirement":50,"AvailabilityRequirement":50,"ModifiedAttackVector":50,"ModifiedAttackComplexity":50,"ModifiedAttackRequirements":50,"ModifiedPrivilegesRequired":50,"ModifiedUserInteraction":50,"ModifiedVulnConfidentialityImpact":50,"ModifiedVulnIntegrityImpact":50,"ModifiedVulnAvailabilityImpact":50,"ModifiedSubConfidentialityImpact":50,"ModifiedSubIntegrityImpact":50,"ModifiedSubAvailabilityImpact":50,"Safety":50,"Automatable":50,"Recovery":50,"ValueDensity":50,"VulnerabilityResponseEffort":50,"ProviderUrgency":50},"4.0","PRESENT","PASSIVE","NOT_DEFINED",0.00664,[51,51,51,51,51,51,51],"High",[55],{"vendor":56,"product":57,"version":58,"criteria":59,"vulnerable":4},"lfprojects","mcp_go_sdk","*","cpe:2.3:a:lfprojects:mcp_go_sdk:*:*:*:*:*:*:*:*",1,[62,67,71,75,79,83,86,89],{"url":63,"source":64,"tags":65},"https:\u002F\u002Fgithub.com\u002Fmodelcontextprotocol\u002Fgo-sdk\u002Fcommit\u002F67bd3f2e2b53ce11a16db8d976cdb8ff1e986b6d","GitHub",[66],"Patch",{"url":68,"source":64,"tags":69},"https:\u002F\u002Fgithub.com\u002Fmodelcontextprotocol\u002Fgo-sdk\u002Fpull\u002F760",[70,66],"Issue Tracking",{"url":72,"source":64,"tags":73},"https:\u002F\u002Fgithub.com\u002Fmodelcontextprotocol\u002Fgo-sdk\u002Freleases\u002Ftag\u002Fv1.4.0",[74],"Release Notes",{"url":76,"source":64,"tags":77},"https:\u002F\u002Fgithub.com\u002Fmodelcontextprotocol\u002Fgo-sdk\u002Fsecurity\u002Fadvisories\u002FGHSA-xw59-hvm2-8pj6",[78],"Vendor Advisory",{"url":80,"source":81,"tags":82},"https:\u002F\u002Faccess.redhat.com\u002Ferrata\u002FRHSA-2026:21772","Red Hat",[],{"url":84,"source":81,"tags":85},"https:\u002F\u002Faccess.redhat.com\u002Fsecurity\u002Fcve\u002FCVE-2026-34742",[],{"url":87,"source":81,"tags":88},"https:\u002F\u002Fbugzilla.redhat.com\u002Fshow_bug.cgi?id=2454608",[],{"url":90,"source":81,"tags":91},"https:\u002F\u002Fsecurity.access.redhat.com\u002Fdata\u002Fcsaf\u002Fv2\u002Fvex\u002F2026\u002Fcve-2026-34742.json",[],[93],{"id":94,"name":95,"description":96,"extendedDescription":97,"status":98,"abstraction":99,"structure":100},"CWE-1188","Initialization of a Resource with an Insecure Default","The product initializes or sets a resource with a default that is intended to be changed by the administrator, but the default is not secure.","Developers often choose default values that leave the product as open and easy to use as possible out-of-the-box, under the assumption that the administrator can (or should) change the default value.  However, this ease-of-use comes at a cost when the default is insecure and the administrator does not change it.","Incomplete","Base","Simple",false,[],{"title":104,"metaDescription":105,"keywords":106,"canonicalUrl":107,"structuredData":108},"What is CVE-2026-34742? Vulnerability Analysis | Security Advisory | Precursor Intelligence","Comprehensive analysis of CVE-2026-34742, a high severity cyber security vulnerability from 2026. The Go MCP SDK used Go's standard encoding\u002Fjson. Prior to v...","CVE-2026-34742, CVE-2026-34742 vulnerability, CVE-2026-34742 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research, vulnerability assessment, cyber threats, 2026, CVSS score, exploit, patch, remediation, lfprojects security, mcp_go_sdk vulnerability","\u002Fwhat-is\u002Fcve-2026-34742",{"@context":109,"@type":110,"headline":104,"description":105,"datePublished":10,"dateModified":11,"author":111,"publisher":115,"about":119,"mainEntityOfPage":123,"articleSection":126,"keywords":127},"https:\u002F\u002Fschema.org","TechArticle",{"@type":112,"name":113,"url":114},"Organization","Precursor Intelligence","https:\u002F\u002Fprecursorintelligence.com",{"@type":112,"name":113,"url":114,"logo":116},{"@type":117,"url":118},"ImageObject","https:\u002F\u002Fprecursorintelligence.com\u002Fimg\u002Flogos\u002Feplogo.png",{"@type":120,"name":6,"description":121,"additionalType":122},"Thing","Cybersecurity Vulnerability","https:\u002F\u002Fschema.org\u002FSoftwareBug",{"@type":124,"@id":125},"WebPage","https:\u002F\u002Fprecursorintelligence.com\u002Fwhat-is\u002Fcve-2026-34742","Cybersecurity","CVE-2026-34742, CVE-2026-34742 vulnerability, CVE-2026-34742 security, high severity vulnerability, cybersecurity, vulnerability analysis, security advisory, CVE database, threat intelligence, security research",[129],{"Operator":29,"Negate":29,"Nodes":130},[131],{"Operator":132,"Negate":101,"CPEMatch":133},"OR",[134],{"Vulnerable":4,"Criteria":59,"MatchCriteriaID":135,"VersionStartExcluding":29,"VersionStartIncluding":29,"VersionEndExcluding":136,"VersionEndIncluding":29},"92CB3EED-2D8E-4ADC-BD05-2A14C13CA7DA","1.4.0",[],[139],{"id":140,"eventType":141,"eventTime":142,"details":143,"label":144,"color":145},"678ef4ac-93c2-4d13-84f7-b4740c99128a","NEW_NVD","2026-04-13T15:55:41.746473+00:00","New CVE added to NVD","Published to NVD","blue",{"lastModified":11,"cacheTime":147,"version":148},1792368257659,"2.0",{"score":150,"band":151,"action":152,"scoredAt":153},47,"Medium","Plan remediation","2026-10-16T07:12:32.365083+00:00"]