GHSA-q382-vc8q-7jhj Improper handling of null Unicode character when parsing JSON in github.com/modelcontextprotocol/go-sdk

• Go github.com/modelcontextprotocol/go-sdk: < 1.4.1 → fixed in 1.4.1

The Go SDK recently transitioned to the `segmentio/encoding` library for JSON parsing in version 1.3.1. While this change addressed both case-insensitivity and ASCII folding issues, the new parser implemented aggressive key matching that treated keys with `null` Unicode characters appended at the end as equivalent to their base strings. Impact When combined with duplicate keys, the described behavior leads to a "last key wins" resolution that could override the intended MCP message. This had the potential for: • Bypassing intermediary inspection: Proxies or policy layers that matched on exact field names may have failed to detect or filter these messages. • Cross-implementation inconsistency: Other MCP SDKs (TypeScript, Python) use case-sensitive parsing and would reject the same messages, creating potential security-boundary confusion. Fix: The `segmentio/encoding` package was patched with a fix in https://github.com/segmentio/encoding/commit/7d5a25dbc5da13aed3cb047a127e4d0e96f536fb and a new version of the package was released (`v0.5.4`). The SDK switched to the patched version of the dependency in 724dd47aa. Users are advised to update to v1.4.1 to resolve this issue. Credits: Thank you to Francesco Lacerenza (Doyensec) for reporting this issue.