{"id":"GHSA-q382-vc8q-7jhj","aliases":["GO-2026-4770"],"status":"published","title":"Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk","description":"The Go SDK recently transitioned to the `segmentio/encoding` library for JSON parsing in version 1.3.1. While this change addressed both case-insensitivity and ASCII folding issues, the new parser implemented aggressive key matching that treated keys with `null` Unicode characters appended at the end as equivalent to their base strings.\n\n#### Impact\n\nWhen combined with duplicate keys, the described behavior leads to a \"last key wins\" resolution that could override the intended MCP message. This had the potential for:\n  - **Bypassing intermediary inspection:** Proxies or policy layers that matched on exact field names may have failed to detect or filter these messages.\n  - **Cross-implementation inconsistency:** Other MCP SDKs (TypeScript, Python) use case-sensitive parsing and would reject the same messages, creating potential security-boundary confusion.\n\n####  Fix:\n\nThe `segmentio/encoding` package was patched with a fix in https://github.com/segmentio/encoding/commit/7d5a25dbc5da13aed3cb047a127e4d0e96f536fb and a new version of the package was released (`v0.5.4`). The SDK switched to the patched version of the dependency in 724dd47aa. Users are advised to update to v1.4.1 to resolve this issue.\n\n#### Credits:\nThank you to Francesco Lacerenza (Doyensec) for reporting this issue.","severity":{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1395","CWE-436"],"published":"2026-03-19T12:44:07Z","modified":"2026-09-10T03:50:40Z","fixes":[{"ecosystem":"Go","package":"github.com/modelcontextprotocol/go-sdk","fixed_in":["1.4.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/modelcontextprotocol/go-sdk","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.4.0"},{"fixed":"1.4.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/modelcontextprotocol/go-sdk","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.4.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/modelcontextprotocol/go-sdk","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.4.1"}]}]}],"references":[{"url":"https://github.com/modelcontextprotocol/go-sdk/security/advisories/GHSA-q382-vc8q-7jhj","tags":["web","advisory"]},{"url":"https://github.com/modelcontextprotocol/go-sdk/commit/724dd47aa3431b9d4cf9ac2eebbf7b38a629afca","tags":["web","fix"]},{"url":"https://github.com/segmentio/encoding/commit/7d5a25dbc5da13aed3cb047a127e4d0e96f536fb","tags":["web"]},{"url":"https://github.com/advisories/GHSA-q382-vc8q-7jhj"},{"url":"https://github.com/modelcontextprotocol/go-sdk","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-q382-vc8q-7jhj","title":"Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk","description":"The Go SDK recently transitioned to the `segmentio/encoding` library for JSON parsing in version 1.3.1. While this change addressed both case-insensitivity and ASCII folding issues, the new parser implemented aggressive key matching that treated keys with `null` Unicode characters appended at the end as equivalent to their base strings.\n\n#### Impact\n\nWhen combined with duplicate keys, the described behavior leads to a \"last key wins\" resolution that could override the intended MCP message. This had the potential for:\n  - **Bypassing intermediary inspection:** Proxies or policy layers that matched on exact field names may have failed to detect or filter these messages.\n  - **Cross-implementation inconsistency:** Other MCP SDKs (TypeScript, Python) use case-sensitive parsing and would reject the same messages, creating potential security-boundary confusion.\n\n####  Fix:\n\nThe `segmentio/encoding` package was patched with a fix in https://github.com/segmentio/encoding/commit/7d5a25dbc5da13aed3cb047a127e4d0e96f536fb and a new version of the package was released (`v0.5.4`). The SDK switched to the patched version of the dependency in 724dd47aa. Users are advised to update to v1.4.1 to resolve this issue.\n\n#### Credits:\nThank you to Francesco Lacerenza (Doyensec) for reporting this issue.","status":"published","published":"2026-03-19T12:44:07Z","modified":"2026-03-19T12:44:08Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N","level":"high"}],"cwes":["CWE-436","CWE-1395"],"updated_at":"2026-11-02T14:39:37.554665Z"}],"osv":[{"id":"GHSA-q382-vc8q-7jhj","title":"Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk","description":"The Go SDK recently transitioned to the `segmentio/encoding` library for JSON parsing in version 1.3.1. While this change addressed both case-insensitivity and ASCII folding issues, the new parser implemented aggressive key matching that treated keys with `null` Unicode characters appended at the end as equivalent to their base strings.\n\n#### Impact\n\nWhen combined with duplicate keys, the described behavior leads to a \"last key wins\" resolution that could override the intended MCP message. This had the potential for:\n  - **Bypassing intermediary inspection:** Proxies or policy layers that matched on exact field names may have failed to detect or filter these messages.\n  - **Cross-implementation inconsistency:** Other MCP SDKs (TypeScript, Python) use case-sensitive parsing and would reject the same messages, creating potential security-boundary confusion.\n\n####  Fix:\n\nThe `segmentio/encoding` package was patched with a fix in https://github.com/segmentio/encoding/commit/7d5a25dbc5da13aed3cb047a127e4d0e96f536fb and a new version of the package was released (`v0.5.4`). The SDK switched to the patched version of the dependency in 724dd47aa. Users are advised to update to v1.4.1 to resolve this issue.\n\n#### Credits:\nThank you to Francesco Lacerenza (Doyensec) for reporting this issue.","status":"published","published":"2026-03-19T12:44:07Z","modified":"2026-09-10T03:50:40.418626415Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N","level":"high"}],"cwes":["CWE-1395","CWE-436"],"updated_at":"2026-11-02T15:46:54.055966Z"},{"id":"GO-2026-4770","title":"Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk","description":"Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk","status":"published","published":"2026-03-23T18:14:51Z","modified":"2026-03-25T15:29:13.034372Z","updated_at":"2026-11-02T15:47:02.280725Z"}]}}