Skip to content
OpenAdvisories

Product · modelcontextprotocol

ruby-sdk

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 6.2
    CVE-2026-63119

    MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)

    MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StdioTransport and MCP::Client::Stdio in the mcp gem use IO#gets without a byte limit, allowing a peer that sends data without a ne…

    modelcontextprotocol ruby-sdk mcp RubyGems
  • Medium 5.3
    CVE-2026-67430

    MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood

    MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not expire sessions by default, so repeated initialize requests retain unbounded Server…

    modelcontextprotocol ruby-sdk mcp RubyGems
  • Medium 6.9
    CVE-2026-63118

    MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection

    MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not validate the HTTP Host or Origin request headers, which allows a malicious browser …

    modelcontextprotocol ruby-sdk mcp RubyGems