Medium severity · published Jul 29, 2026
CVE-2026-67430
MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood
5.3
CVSS
0.4%
EPSS
No
On KEV
Description
MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not expire sessions by default, so repeated initialize requests retain unbounded ServerSession objects and can exhaust process memory. This issue is fixed in version 0.23.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 30% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RU
ruby-sdk · modelcontextprotocol
< 0.23.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-67430
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-67430
github.com
https://github.com/modelcontextprotocol/ruby-sdk/commit/afb968c468c178c4d3294b423fcce250621692f4
github.com
https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0
github.com
https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-52jp-gj8w-j6xh
More from ruby-sdk
8.3
CVE-2026-67431
MCP Ruby SDK: Ruby SSE Session Poisoning
7.5
CVE-2026-67432
MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport
6.9
CVE-2026-63118
MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection
6.2
CVE-2026-63119
MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)
5.9
CVE-2026-33946
MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay