CVE-2026-67430 Details
Description
MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not expire sessions by default, so repeated initialize requests retain unbounded ServerSession objects and can exhaust process memory. This issue is fixed in version 0.23.0.
A denial-of-service vulnerability has been identified in the MCP Ruby SDK, specifically within the StreamableHTTPTransport component of the mcp gem, in versions prior to 0.23.0. The issue arises because sessions do not expire by default, allowing an unauthenticated attacker to flood the server with initialize requests. This flood creates and retains an unbounded number of ServerSession objects, leading to memory exhaustion. The vulnerability can be reproduced by sending a high volume of initialize requests, which are accepted and stored as active sessions until the server runs out of memory.
Users can update to MCP Ruby SDK version 0.23.0 or later, where this vulnerability has been fixed. The updated version includes a default session idle timeout of 30 minutes and a maximum concurrent session limit of 10,000, preventing the unbounded session retention that led to the denial-of-service condition.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 29, 2026CISA-ADP
Assessed Jul 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-52jp-gj8w-j6xh | CISA-ADP | AdvisoryRemedyVendor |
| https://github.com/modelcontextprotocol/ruby-sdk/commit/afb968c468c178c4d3294b423fcce250621692f4 | [email protected] | Source CodeVendor |
| https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0 | [email protected] | Release NotesVendor |
| https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-52jp-gj8w-j6xh | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-401 | Missing Release of Memory after Effective Lifetime | [email protected] |
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| MCP Ruby SDK | <= 0.22.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 30, 2026 | CVE Modified | CISA-ADP |
| Jul 29, 2026 | New CVE Received | [email protected] |