EUVD-2026-50502
GHSA-h669-8m4g-r2hc
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach MCP HTTP endpoint
-
DeliverySend oversized JSON-RPC POST body
-
ExploitUnbounded read into worker memory
-
ExecutionMemory exhaustion / OOM kill
-
ImpactServer denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The MCP server must expose MCP::Server::Transports::StreamableHTTPTransport over HTTP to the attacker (the Streamable HTTP transport is the required deployment mode - stdio-only servers are not exposed to this remote vector). Given that, no special conditions apply: remote unauthenticated exploitation (PR:N/UI:N) against default configurations of any mcp-gem server below 0.23.0, since the pre-patch default had no request-size or nesting limit at all. Limiting factors: the endpoint must be network-reachable by the attacker, and the impact is confined to availability (worker memory exhaustion) - no data disclosure or code execution. Deployments only using the stdio client/server transport, or already fronted by a proxy that caps body size, are not exposed via this network path. |
| Impact | Signals are internally consistent and point to a genuine but scope-limited availability risk. The CVSS vector (AV:N/AC:L/PR:N/UI:N, C:N/I:N/A:H) correctly reflects a remote, unauthenticated, low-complexity denial of service with no confidentiality or integrity impact, matching the description exactly. No EPSS score, KEV entry, or POC was provided; exploitation status is therefore 'no public exploit identified at time of analysis,' though the public commit diff makes weaponization straightforward. This is a legitimate patch-soon issue for anyone exposing an MCP Ruby server to untrusted networks, but it is not a code-execution or data-exposure emergency - the worst outcome is worker crash/restart. No SSVC decision data was supplied; automatability is plausibly high (a scripted large POST), which would argue for prompt remediation on internet-facing deployments. No conflicting signals were identified. |
| Exploit ScenarioDerived | An attacker who can reach the MCP server's HTTP endpoint sends a single POST to the JSON-RPC route with a multi-gigabyte body (or a chunked request with no/spoofed Content-Length), causing the worker to buffer and parse the whole payload and exhaust memory. Repeating this against each worker keeps the service crashing or OOM-restarting, denying availability to all users. No authentication, user interaction, or special client tooling is required; the public 0.23.0 diff documents the exact unbounded read. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 29, 2026
Uncontrolled memory allocation in the official Model Context Protocol Ruby SDK (mcp gem) before 0.23.0 lets an unauthenticated remote attacker crash MCP servers by sending a single oversized JSON-RPC POST. The StreamableHTTPTransport read the entire request body into memory and parsed it with no size or JSON-nesting cap, so one request can allocate gigabytes and OOM-kill the worker (CVSS 7.5, availability-only impact). No public exploit identified at time of analysis, but the fix commit and 4 MiB default limit are public, making the mechanism trivially reproducible.
RemediationAI
Vendor-released patch: upgrade the mcp gem to 0.23.0 or later, which enforces a 4 MiB default request-body cap (max_request_bytes) and a JSON nesting limit of 64; see GHSA-h669-8m4g-r2hc and the v0.23.0 release notes. If you exchange unusually large payloads you can raise the limit explicitly, e.g. StreamableHTTPTransport.new(server, max_request_bytes: 8 * 1024 * 1024). If immediate upgrade is not possible, place a reverse proxy or WAF in front of the MCP server and cap request body size there (for nginx, client_max_body_size 4m; for many load balancers, a max-body-size rule returning 413) - trade-off: this rejects legitimately large messages and does not bound JSON nesting depth, so it is a partial mitigation only. Also restrict network exposure of the transport to trusted clients where feasible until patched.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 2 packages in rubygems, euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The affected component is MCP::Server::Transports::StreamableHTTPTransport, the HTTP transport used by MCP servers built on the Ruby SDK (cpe:2.3:a:modelcontextprotocol:ruby-sdk). Model Context Protocol is the JSON-RPC-based protocol that connects LLM clients to tool/data servers; the Streamable HTTP transport accepts JSON-RPC messages over HTTP POST. The root cause maps to CWE-770 (Allocation of Resources Without Limits or Throttling): handle_post called request.body.read with no bound and then JSON.parse without a max_nesting limit, so both raw byte volume and parser recursion depth were attacker-controlled. The 0.23.0 fix introduces DEFAULT_MAX_REQUEST_BYTES (4 MiB), a read_bounded_body helper that rejects an over-cap declared Content-Length before reading and also caps the actual read at one byte past the limit to defeat spoofed/chunked Content-Length, an HTTP 413 response, and MAX_JSON_NESTING=64 to bound parse depth.
Know when Ruby Sdk gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Remote unauthenticated POST with no interaction and low complexity triggers unbounded allocation; impact is availability-only (worker OOM), so C:N/I:N/A:H.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
2DescriptionCVE.org
MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem reads and parses an entire JSON-RPC POST body without a size limit, allowing an unauthenticated remote attacker to exhaust process memory. This issue is fixed in version 0.23.0.
Executive ViewAI
The Model Context Protocol Ruby SDK (mcp gem) versions before 0.23.0 contain a memory exhaustion vulnerability allowing unauthenticated remote attackers to crash MCP servers with a single oversized request. No vendor-released patch identified at time of analysis. Organizations deploying this SDK face immediate risk of service disruption and availability loss affecting dependent applications and AI model integrations.
Implement HTTP request size limits (1 MB maximum recommended) at reverse proxy or WAF layer to prevent oversized payloads; configure per-IP rate limiting to throttle requests; enable request timeouts; monitor MCP worker process memory usage with alerting for anomalies; restrict direct MCP server access to trusted networks only; route traffic through load balancers with rate-limiting; run MCP workers with automatic restart policies on out-of-memory events.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Session hijacking in the MCP Ruby SDK (mcp gem) before 0.23.0 lets an attacker who obtains a valid session ID issue tool
DNS rebinding in MCP Ruby SDK's StreamableHTTPTransport (mcp gem, all versions prior to 0.23.0) exposes locally running
Uncontrolled memory growth in the MCP Ruby SDK (mcp gem) prior to 0.23.0 allows any peer process communicating via stdio
Unbounded session growth in MCP Ruby SDK's StreamableHTTPTransport allows unauthenticated remote attackers to exhaust se
Exploit-DB