modelcontextprotocol ruby-sdk vulnerabilities

Newest CVEs

• CVE-2026-67432

  MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport

  modelcontextprotocol · ruby-sdk

  High7.5
• CVE-2026-67431

  MCP Ruby SDK: Ruby SSE Session Poisoning

  modelcontextprotocol · ruby-sdk

  High8.3
• CVE-2026-63119

  MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)

  modelcontextprotocol · ruby-sdk

  Medium6.2
• CVE-2026-67430

  MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood

  modelcontextprotocol · ruby-sdk

  Medium5.3
• CVE-2026-63118

  MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection

  modelcontextprotocol · ruby-sdk

  Medium6.9
• CVE-2026-33946

  MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay

  modelcontextprotocol · ruby-sdk

  High8.2