GHSA-q382-vc8q-7jhj: Github.com/modelcontextprotocol/go sdk Improper Handling Of Null Unicode Vulnerability
HIGHGHSA-q382-vc8q-7jhj is a HIGH improper handling of null unicode vulnerability (CWE-1395: Dependency on Vulnerable Third-Party Component) affecting Github.com/modelcontextprotocol/go sdk libraries in the Go ecosystem. The issue involves improper handling of null unicode character when parsing json in github.com/modelcontextprotocol/go-sdk. Remediation is available by upgrading affected packages to version 1.4.1.
GHSA-q382-vc8q-7jhj at a Glance
How to Fix GHSA-q382-vc8q-7jhj
To remediate this vulnerability, upgrade all affected Github.com/modelcontextprotocol/go sdk dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade github.com/modelcontextprotocol/go-sdk to 1.4.1Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for github.com/modelcontextprotocol/go-sdkHow to Check if You Are Affected
To determine whether your application is affected by GHSA-q382-vc8q-7jhj, inspect your project dependencies for Github.com/modelcontextprotocol/go sdk:
inspect dependencies for github.com/modelcontextprotocol/go-sdkAnalyze the terminal output to locate any version of Github.com/modelcontextprotocol/go sdk in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.4.1), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-1395: Dependency on Vulnerable Third-Party Component, where the product has a dependency on a third-party component that contains one or more known vulnerabilities. In Github.com/modelcontextprotocol/go sdk, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
GHSA-q382-vc8q-7jhj Affected Github.com/modelcontextprotocol/go sdk Versions
1 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
github.com/modelcontextprotocol/go-sdk
|
Go |
< 1.4.1
|
1.4.1
|
References
Frequently Asked Questions
What is GHSA-q382-vc8q-7jhj?
Which Github.com/modelcontextprotocol/go sdk versions are affected?
What version fixes GHSA-q382-vc8q-7jhj?
Is github.com/modelcontextprotocol/go-sdk affected?
What CWE is associated with GHSA-q382-vc8q-7jhj?
How can I check Go dependencies for GHSA-q382-vc8q-7jhj?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-q382-vc8q-7jhj",
"modified" : "2026-03-19T12:44:07Z",
"published" : "2026-03-19T12:44:07Z",
"aliases" : [ ],
"summary" : "Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk",
"details" : "The Go SDK recently transitioned to the `segmentio/encoding` library for JSON parsing in version 1.3.1. While this change addressed both case-insensitivity and ASCII folding issues, the new parser implemented aggressive key matching that treated keys with `null` Unicode characters appended at the end as equivalent to their base strings.\n\n#### Impact\n\nWhen combined with duplicate keys, the described behavior leads to a \"last key wins\" resolution that could override the intended MCP message. This had the potential for:\n - **Bypassing intermediary inspection:** Proxies or policy layers that matched on exact field names may have failed to detect or filter these messages.\n - **Cross-implementation inconsistency:** Other MCP SDKs (TypeScript, Python) use case-sensitive parsing and would reject the same messages, creating potential security-boundary confusion.\n\n#### Fix:\n\nThe `segmentio/encoding` package was patched with a fix in https://github.com/segmentio/encoding/commit/7d5a25dbc5da13aed3cb047a127e4d0e96f536fb and a new version of the package was released (`v0.5.4`). The SDK switched to the patched version of the dependency in 724dd47aa. Users are advised to update to v1.4.1 to resolve this issue.\n\n#### Credits:\nThank you to Francesco Lacerenza (Doyensec) for reporting this issue.",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "Go",
"name" : "github.com/modelcontextprotocol/go-sdk"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "0"
}, {
"fixed" : "1.4.1"
} ]
} ],
"database_specific" : {
"last_known_affected_version_range" : "<= 1.4.0"
}
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/modelcontextprotocol/go-sdk/security/advisories/GHSA-q382-vc8q-7jhj"
}, {
"type" : "WEB",
"url" : "https://github.com/modelcontextprotocol/go-sdk/commit/724dd47aa3431b9d4cf9ac2eebbf7b38a629afca"
}, {
"type" : "WEB",
"url" : "https://github.com/segmentio/encoding/commit/7d5a25dbc5da13aed3cb047a127e4d0e96f536fb"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/modelcontextprotocol/go-sdk"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-1395", "CWE-436" ],
"severity" : "HIGH",
"github_reviewed" : true,
"github_reviewed_at" : "2026-03-19T12:44:07Z",
"nvd_published_at" : null
}
}