MCP Streamable-HTTP Session Churn (Uncaught ClosedResourceError DoS)

How the attack works

An attacker connects to an MCP server's streamable-HTTP endpoint and sends a request that triggers an unhandled ClosedResourceError in the MCP Python SDK (versions before 1.10.0). The server session crashes, so the client's connection is torn down almost immediately after it starts. The client reconnects to keep working, the new session gets killed the same way, and this repeats: many session re-establishments, each carrying at most a couple of requests. The rule watches for exactly this shape - reconnection rate rising while request volume per session stays flat and low.

Netzilo detection

Why it matters

A single client can repeatedly crash the MCP server's session handling, denying service to that endpoint until someone restarts or patches it. The rule flags the pattern for investigation; it cannot confirm the crash itself or distinguish malicious triggering from ordinary instability.

What you can do

• →Upgrade the MCP Python SDK to 1.10.0 or later, which fixes CVE-2025-53365.
• →When this pattern appears, check server logs for ClosedResourceError or other unhandled exceptions around the time of each session drop.
• →Rule out benign causes first: hot-reload dev servers, container restarts/OOM kills, and proxies or load balancers with short idle timeouts all produce the same reconnect pattern.
• →Add process-crash and exception monitoring on the MCP server so future incidents can be confirmed directly instead of inferred from connection behavior.

Known benign look-alikes

• Local MCP server run with hot reload (uvicorn --reload, nodemon, watchexec) restarting on every file save during development, forcing the client to re-establish the streamable HTTP session repeatedly.
• Container or pod restart, rolling deploy, or crash-loop of the MCP server caused by an unrelated bug or an OOM kill.
• Load balancer, service mesh sidecar, or reverse proxy with a short idle timeout terminating long-lived streamable HTTP sessions.
• Flaky network, VPN or ZTNA tunnel re-key causing genuine TCP churn on an otherwise healthy session.
• A batch or CI harness that intentionally runs many short one-shot MCP sessions in a loop against the same endpoint instead of reusing one session.
• An HTTP client configured without keep-alive that polls an endpoint whose path happens to contain /mcp, /sse, /stream or /rpc.

References

• https://nvd.nist.gov/vuln/detail/CVE-2025-53365
• https://github.com/modelcontextprotocol/python-sdk/security/advisories
• https://attack.mitre.org/techniques/T1499/004/