MCP Ruby SDK EUVD-2026-50500

Exploitation requires the attacker to control or compromise a process that holds an open write end of the stdio pipe connected to the vulnerable Ruby MCP server or client - this is inherently local inter-process access, not a network-reachable condition by default. The flaw is present in the default configuration of all pre-0.23.0 releases; no non-default setting is required to be vulnerable, as the byte limit was simply absent before v0.23.0. Exploitation is limited to availability impact (OOM kill of the MCP process); no confidentiality or integrity impact has been identified. Deployments that front-end a local MCP stdio process with a network-accessible broker that forwards untrusted client data into that stdio channel expand the effective attack surface, but such a configuration is not default. Limiting factors: the attacker must be co-located on the same host or have pipe-level access; pure network-only attackers cannot reach the stdio transport without an additional path through a proxy or broker.

The CVSS 6.2 score with vector AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H accurately characterizes this as a local denial-of-service with no confidentiality or integrity impact. The local attack vector reflects the stdio transport model, where the peer is a co-located process; however, in MCP architectures where a broker or proxy forwards untrusted network data into a local stdio transport, the practical barrier drops considerably. Attack complexity is genuinely low once stdio access is achieved - no exploit sophistication is required, only the ability to write bytes without a newline. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified. No KEV listing and no public POC exist, so real-world exploitation is unconfirmed. Net risk is moderate for deployments that expose MCP servers to untrusted or semi-trusted peers; deployments where all stdio peers are fully controlled reduce residual risk substantially.

A malicious or compromised MCP peer process writes a continuous stream of arbitrary bytes to the stdin of a Ruby MCP server running an unpatched mcp gem, deliberately omitting any newline character. Ruby's IO#gets accumulates this input into a single ever-growing String, eventually exhausting the host's available memory and triggering an OOM kill that terminates the MCP service entirely. No public POC has been identified, but the attack requires only write access to the target process's stdin pipe.