MCP Ruby SDK CVE-2026-67430

The target must be running a version of the mcp Ruby gem prior to 0.23.0 with MCP::Server::Transports::StreamableHTTPTransport in stateful mode (stateless: false, the default). The HTTP initialize endpoint must be network-reachable by the attacker - if the server is behind an authenticating reverse proxy or not exposed externally, unauthenticated exploitation is blocked at the network layer. No user interaction, special protocol knowledge, or prior session state is required. Stateless mode (stateless: true) is explicitly immune regardless of version. The limiting factor for impact is available process memory and host OOM behavior: on systems with large memory allocations or OOM score adjustments, memory exhaustion may be slow or incomplete before the process is killed.

The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L) accurately reflects the network-accessible, zero-authentication, low-complexity attack surface, but the official A:L rating may understate impact: sustained initialize flooding can fully exhaust process memory and crash the Ruby process, which is closer to A:H behavior. No EPSS data was provided. The vulnerability is not in CISA KEV and no public exploit code has been identified, suggesting no current widespread exploitation. Despite the unauthenticated network vector, real-world risk is moderated by deployment context: MCP SDK servers are predominantly internal AI agent infrastructure or developer tooling, rarely exposed directly to the internet without a reverse proxy or auth layer. The attack is fully automatable (no special tooling required), which raises urgency for any internet-facing deployment. Patch availability as of v0.23.0 eliminates the risk with no required configuration change, as secure defaults are now applied automatically.

An attacker sends a continuous stream of HTTP initialize requests to the StreamableHTTPTransport endpoint without ever issuing DELETE requests. Each request allocates a new ServerSession object retained indefinitely in the session hash. Over time, the Ruby process's heap grows until the OS OOM-kills the process, denying service to legitimate MCP clients. No authentication, special tooling, or prior knowledge of the target is required - a simple loop with curl or a script suffices.