CVE-2026-63119 Details
Description
MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StdioTransport and MCP::Client::Stdio in the mcp gem use IO#gets without a byte limit, allowing a peer that sends data without a newline to exhaust process memory. This issue is fixed in version 0.23.0.
A denial-of-service vulnerability has been identified in the MCP Ruby SDK, specifically in the stdio transport components of both the server and client. Prior to version 0.23.0, these components used the IO#gets method without a byte limit. This oversight allowed a peer to send data without newlines, leading to unbounded memory consumption. The issue arises because IO#gets, when unconfined, reads data until a newline is encountered, with no restriction on the amount of data that can be accumulated. As a result, a process can be terminated by the operating system's out-of-memory killer.
Users can update to MCP Ruby SDK version 0.23.0 or later, where this vulnerability has been fixed. The updated version introduces a configurable maximum line length for stdin frames, preventing unbounded memory growth.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 29, 2026CISA-ADP
Assessed Jul 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-7683-3w9x-ch42 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/modelcontextprotocol/ruby-sdk/commit/267b8fa6285453525c81ce43db6b7dcd7a8a8c2f | [email protected] | Source CodeVendor |
| https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0 | [email protected] | Release NotesVendor |
| https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-7683-3w9x-ch42 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| MCP Ruby SDK | <= 0.22.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 29, 2026 | New CVE Received | [email protected] |
| Jul 29, 2026 | CVE Modified | CISA-ADP |