Skip to content
OpenAdvisories

Product · modelcontextprotocol

ruby-sdk

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 7.5
    CVE-2026-67432

    MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport

    MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem reads and parses an entire JSON-RPC POST body without a size limit, allowing an unauthentica…

    modelcontextprotocol ruby-sdk mcp RubyGems
  • High 8.3
    CVE-2026-67431

    MCP Ruby SDK: Ruby SSE Session Poisoning

    MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not bind a session ID to a session owner, allowing an attacker with a stolen session ID…

    modelcontextprotocol ruby-sdk mcp RubyGems
  • High 8.2
    CVE-2026-33946

    MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay

    MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to version 0.9.2, the Ruby SDK's streamable_http_transport.rb implementation contains a session hijacking vulnerability. An attacker who obtains a valid session ID can…

    modelcontextprotocol ruby-sdk mcp RubyGems