CVE-2025-64443

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2025-64443
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2025-64443.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2025-64443
Aliases
Published
2025-12-03T17:41:59.272Z
Modified
2025-12-03T19:42:26.985459Z
Severity
  • 7.3 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:H/VA:N/SC:H/SI:H/SA:H CVSS Calculator
Summary
DNS Rebinding vulnerability present when running MCP Gateway in sse or streaming mode
Details

MCP Gateway allows easy and secure running and deployment of MCP servers. In versions 0.27.0 and earlier, when MCP Gateway runs in sse or streaming transport mode, it is vulnerable to DNS rebinding. An attacker who can get a victim to visit a malicious website or be served a malicious advertisement can perform browser-based exploitation of MCP servers executing behind the gateway, including manipulating tools or other features exposed by those MCP servers. MCP Gateway is not affected when running in the default stdio mode, which does not listen on network ports. Version 0.28.0 fixes this issue.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64443.json",
    "cwe_ids": [
        "CWE-749"
    ]
}
References

Affected packages

Git / github.com/docker/mcp-gateway

Affected ranges

Type
GIT
Repo
https://github.com/docker/mcp-gateway
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
55f34cf062fd204d2a32a0b1d2ee1794981d9ee9
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.28.0"
        }
    ]
}

Affected versions

v0.*

v0.10.0
v0.11.0
v0.12.0
v0.13.0
v0.14.0
v0.15.0
v0.16.0
v0.17.0
v0.18.0
v0.19.0
v0.20.0
v0.21.0
v0.22.0
v0.23.0
v0.24.0
v0.25.0
v0.26.0
v0.27.0
v0.4.0
v0.4.1
v0.4.2
v0.4.3
v0.4.4
v0.5.0
v0.5.1
v0.5.2
v0.5.3
v0.6.0
v0.7.0
v0.7.1
v0.7.2
v0.7.3
v0.7.4
v0.8.0
v0.9.0
v0.9.1
v0.9.3
v0.9.4
v0.9.5
v0.9.6
v0.9.7
v0.9.8
v0.9.9