CVE-2026-67430
MEDIUMMCP Ruby SDK < 0.23.0 - StreamableHTTPTransport Memory Exhaustion
Title source: manualDescription
MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not expire sessions by default, so repeated initialize requests retain unbounded ServerSession objects and can exhaust process memory. This issue is fixed in version 0.23.0.
References (3)
Core 3
Core References
X_Refsource_Confirm x_refsource_confirm
https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-52jp-gj8w-j6xh
X_Refsource_Misc x_refsource_misc
https://github.com/modelcontextprotocol/ruby-sdk/commit/afb968c468c178c4d3294b423fcce250621692f4
X_Refsource_Misc x_refsource_misc
https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0
Scores
CVSS v3
5.3
EPSS
0.0029
EPSS Percentile
21.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
partial
Details
CWE
CWE-401
CWE-770
Status
published
Products (2)
modelcontextprotocol/ruby-sdk
< 0.23.0
rubygems/mcp
0 - 0.23.0RubyGems
Published
Jul 29, 2026
Tracked Since
Jul 30, 2026