Login Request a demo
RU
Product
ruby-sdk
by modelcontextprotocol · last CVE Jul 29, 2026
6
CVEs
0
On KEV
8.3
Max CVSS
0
New 30D
Vulnerabilities6In the news0Timeline
Severity mix
Critical 0High 2Medium 4Low 0
Severity
All severities6Critical0High2Medium4Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add ruby-sdk to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-67431
8.3
0%
Jul 29
MCP Ruby SDK: Ruby SSE Session Poisoning
Affected: < 0.23.0
CVE-2026-67432
7.5
1%
Jul 29
MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport
Affected: < 0.23.0
CVE-2026-63118
6.9
0%
Jul 29
MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection
Affected: < 0.23.0
CVE-2026-63119
6.2
0%
Jul 29
MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)
Affected: < 0.23.0
CVE-2026-33946
5.9
0%
Mar 27
MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay
Affected: < 0.9.2
CVE-2026-67430
5.3
0%
Jul 29
MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood
Affected: < 0.23.0
Showing 6