CVE-2026-67432 Details
Description
MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem reads and parses an entire JSON-RPC POST body without a size limit, allowing an unauthenticated remote attacker to exhaust process memory. This issue is fixed in version 0.23.0.
A denial-of-service vulnerability has been identified in the MCP Ruby SDK, specifically in versions through 0.22.0. The issue resides in the StreamableHTTPTransport component, which handles JSON-RPC POST requests. Prior to version 0.23.0, this transport could be exploited by an unauthenticated remote attacker who sent an oversized JSON-RPC POST. The transport would read and parse the entire request body into memory without any size limitations, leading to excessive memory consumption and causing the server process to run out of memory.
Users can upgrade to MCP Ruby SDK version 0.23.0 or later, where this vulnerability has been fixed. In the updated version, StreamableHTTPTransport includes a default maximum request size limit of 4 MiB, and the same limit can be applied to standard input frame reads in the StdioTransport.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 29, 2026CISA-ADP
Assessed Jul 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-h669-8m4g-r2hc | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/modelcontextprotocol/ruby-sdk/commit/772e0cb1f9db69312006926eee59a7287ad50166 | [email protected] | Source CodeVendor |
| https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0 | [email protected] | Release NotesVendor |
| https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-h669-8m4g-r2hc | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| MCP Ruby SDK | <= 0.22.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 29, 2026 | New CVE Received | [email protected] |
| Jul 29, 2026 | CVE Modified | CISA-ADP |