Modelcontextprotocol
Monthly
Uncontrolled memory allocation in the official Model Context Protocol Ruby SDK (mcp gem) before 0.23.0 lets an unauthenticated remote attacker crash MCP servers by sending a single oversized JSON-RPC POST. The StreamableHTTPTransport read the entire request body into memory and parsed it with no size or JSON-nesting cap, so one request can allocate gigabytes and OOM-kill the worker (CVSS 7.5, availability-only impact). No public exploit identified at time of analysis, but the fix commit and 4 MiB default limit are public, making the mechanism trivially reproducible.
Session hijacking in the MCP Ruby SDK (mcp gem) before 0.23.0 lets an attacker who obtains a valid session ID issue tools/call requests that execute inside the victim's session, because StreamableHTTPTransport validates only session existence and idle timeout without binding a session to its owner. Affected deployments are those exposing the streamable HTTP transport; the flaw enables cross-session action execution and in-flight request tampering (e.g. notifications/cancelled). No public exploit identified at time of analysis and the issue is not in CISA KEV; the vendor CVSS 4.0 score is 8.3 (integrity-focused).
Uncontrolled memory growth in the MCP Ruby SDK (mcp gem) prior to 0.23.0 allows any peer process communicating via stdio to OOM-kill the host Ruby process by sending a continuous byte stream without a newline, exhausting available system memory. Both the server-side MCP::Server::Transports::StdioTransport and client-side MCP::Client::Stdio components are affected, meaning Ruby applications acting as either MCP servers or MCP clients are vulnerable. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the attack is mechanically trivial for any process with stdio access to the target.
Unbounded session growth in MCP Ruby SDK's StreamableHTTPTransport allows unauthenticated remote attackers to exhaust server process memory by repeatedly sending initialize requests. Affected versions prior to 0.23.0 defaulted to no session expiry and no concurrent session cap, meaning each initialize request created a persistent ServerSession object that was never reclaimed without an explicit client DELETE. No public exploit has been identified at time of analysis, and exploitation is not confirmed by CISA KEV, but the attack is trivially automatable given the network-accessible, unauthenticated HTTP endpoint.
DNS rebinding in MCP Ruby SDK's StreamableHTTPTransport (mcp gem, all versions prior to 0.23.0) exposes locally running MCP servers to browser-driven tool invocation without authentication. The transport accepted HTTP requests without validating Host or Origin headers, allowing a malicious webpage to exploit short-TTL DNS re-resolution to reach the victim's loopback-bound server and call any registered MCP tool. No public exploit code is identified at time of analysis, and no CISA KEV listing exists; however, the CVSS 4.0 score of 6.9 with VC:H and SC:H reflects a meaningful confidentiality risk for developers actively using local MCP tooling alongside a browser.
Cross-origin WebSocket hijacking in the Model Context Protocol Python SDK (mcp on PyPI) before 1.28.1 lets a remote web page connect to any application exposing the deprecated mcp.server.websocket.websocket_server transport, because that transport accepted handshakes without Host or Origin validation and offered no SDK-level control to restrict connecting origins. A malicious site loaded in a victim's browser can therefore open an MCP session against a locally reachable server and drive its tools. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the tags flag it as information disclosure.
Missing authorization in the MCP Python SDK (the `mcp` PyPI package) versions 1.23.0 through 1.27.1 lets any authenticated client of a multi-client server enumerate, read the results of, consume messages from, or cancel tasks belonging to other clients. The default handlers wired up by `server.experimental.enable_tasks()` for tasks/list, tasks/get, tasks/result, and tasks/cancel key solely on the task identifier and never bind a task to the session that created it. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the upstream fix, deprecation warnings, and detailed advisory confirm the flaw; it is resolved in version 1.27.2.
Cross-session message injection in the MCP Python SDK (the 'mcp' package on PyPI) prior to 1.27.2 allows an authenticated client holding a valid bearer token to hijack another principal's session on the SSE and stateful Streamable HTTP transports. Because SseServerTransport and StreamableHTTPSessionManager route inbound requests using only the session_id query parameter or Mcp-Session-Id header - never checking that the caller is the same authenticated principal who created the session - any bearer-token-authenticated client who learns a victim's session ID can inject arbitrary JSON-RPC messages into that session. There is no public exploit identified at time of analysis and no CISA KEV listing; the flaw is fixed in version 1.27.2.
Uncontrolled memory allocation in the official Model Context Protocol Ruby SDK (mcp gem) before 0.23.0 lets an unauthenticated remote attacker crash MCP servers by sending a single oversized JSON-RPC POST. The StreamableHTTPTransport read the entire request body into memory and parsed it with no size or JSON-nesting cap, so one request can allocate gigabytes and OOM-kill the worker (CVSS 7.5, availability-only impact). No public exploit identified at time of analysis, but the fix commit and 4 MiB default limit are public, making the mechanism trivially reproducible.
Session hijacking in the MCP Ruby SDK (mcp gem) before 0.23.0 lets an attacker who obtains a valid session ID issue tools/call requests that execute inside the victim's session, because StreamableHTTPTransport validates only session existence and idle timeout without binding a session to its owner. Affected deployments are those exposing the streamable HTTP transport; the flaw enables cross-session action execution and in-flight request tampering (e.g. notifications/cancelled). No public exploit identified at time of analysis and the issue is not in CISA KEV; the vendor CVSS 4.0 score is 8.3 (integrity-focused).
Uncontrolled memory growth in the MCP Ruby SDK (mcp gem) prior to 0.23.0 allows any peer process communicating via stdio to OOM-kill the host Ruby process by sending a continuous byte stream without a newline, exhausting available system memory. Both the server-side MCP::Server::Transports::StdioTransport and client-side MCP::Client::Stdio components are affected, meaning Ruby applications acting as either MCP servers or MCP clients are vulnerable. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the attack is mechanically trivial for any process with stdio access to the target.
Unbounded session growth in MCP Ruby SDK's StreamableHTTPTransport allows unauthenticated remote attackers to exhaust server process memory by repeatedly sending initialize requests. Affected versions prior to 0.23.0 defaulted to no session expiry and no concurrent session cap, meaning each initialize request created a persistent ServerSession object that was never reclaimed without an explicit client DELETE. No public exploit has been identified at time of analysis, and exploitation is not confirmed by CISA KEV, but the attack is trivially automatable given the network-accessible, unauthenticated HTTP endpoint.
DNS rebinding in MCP Ruby SDK's StreamableHTTPTransport (mcp gem, all versions prior to 0.23.0) exposes locally running MCP servers to browser-driven tool invocation without authentication. The transport accepted HTTP requests without validating Host or Origin headers, allowing a malicious webpage to exploit short-TTL DNS re-resolution to reach the victim's loopback-bound server and call any registered MCP tool. No public exploit code is identified at time of analysis, and no CISA KEV listing exists; however, the CVSS 4.0 score of 6.9 with VC:H and SC:H reflects a meaningful confidentiality risk for developers actively using local MCP tooling alongside a browser.
Cross-origin WebSocket hijacking in the Model Context Protocol Python SDK (mcp on PyPI) before 1.28.1 lets a remote web page connect to any application exposing the deprecated mcp.server.websocket.websocket_server transport, because that transport accepted handshakes without Host or Origin validation and offered no SDK-level control to restrict connecting origins. A malicious site loaded in a victim's browser can therefore open an MCP session against a locally reachable server and drive its tools. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV; the tags flag it as information disclosure.
Missing authorization in the MCP Python SDK (the `mcp` PyPI package) versions 1.23.0 through 1.27.1 lets any authenticated client of a multi-client server enumerate, read the results of, consume messages from, or cancel tasks belonging to other clients. The default handlers wired up by `server.experimental.enable_tasks()` for tasks/list, tasks/get, tasks/result, and tasks/cancel key solely on the task identifier and never bind a task to the session that created it. There is no public exploit identified at time of analysis and it is not in CISA KEV, but the upstream fix, deprecation warnings, and detailed advisory confirm the flaw; it is resolved in version 1.27.2.
Cross-session message injection in the MCP Python SDK (the 'mcp' package on PyPI) prior to 1.27.2 allows an authenticated client holding a valid bearer token to hijack another principal's session on the SSE and stateful Streamable HTTP transports. Because SseServerTransport and StreamableHTTPSessionManager route inbound requests using only the session_id query parameter or Mcp-Session-Id header - never checking that the caller is the same authenticated principal who created the session - any bearer-token-authenticated client who learns a victim's session ID can inject arbitrary JSON-RPC messages into that session. There is no public exploit identified at time of analysis and no CISA KEV listing; the flaw is fixed in version 1.27.2.