Ruby Sdk
Monthly
Uncontrolled memory allocation in the official Model Context Protocol Ruby SDK (mcp gem) before 0.23.0 lets an unauthenticated remote attacker crash MCP servers by sending a single oversized JSON-RPC POST. The StreamableHTTPTransport read the entire request body into memory and parsed it with no size or JSON-nesting cap, so one request can allocate gigabytes and OOM-kill the worker (CVSS 7.5, availability-only impact). No public exploit identified at time of analysis, but the fix commit and 4 MiB default limit are public, making the mechanism trivially reproducible.
Session hijacking in the MCP Ruby SDK (mcp gem) before 0.23.0 lets an attacker who obtains a valid session ID issue tools/call requests that execute inside the victim's session, because StreamableHTTPTransport validates only session existence and idle timeout without binding a session to its owner. Affected deployments are those exposing the streamable HTTP transport; the flaw enables cross-session action execution and in-flight request tampering (e.g. notifications/cancelled). No public exploit identified at time of analysis and the issue is not in CISA KEV; the vendor CVSS 4.0 score is 8.3 (integrity-focused).
Uncontrolled memory growth in the MCP Ruby SDK (mcp gem) prior to 0.23.0 allows any peer process communicating via stdio to OOM-kill the host Ruby process by sending a continuous byte stream without a newline, exhausting available system memory. Both the server-side MCP::Server::Transports::StdioTransport and client-side MCP::Client::Stdio components are affected, meaning Ruby applications acting as either MCP servers or MCP clients are vulnerable. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the attack is mechanically trivial for any process with stdio access to the target.
Unbounded session growth in MCP Ruby SDK's StreamableHTTPTransport allows unauthenticated remote attackers to exhaust server process memory by repeatedly sending initialize requests. Affected versions prior to 0.23.0 defaulted to no session expiry and no concurrent session cap, meaning each initialize request created a persistent ServerSession object that was never reclaimed without an explicit client DELETE. No public exploit has been identified at time of analysis, and exploitation is not confirmed by CISA KEV, but the attack is trivially automatable given the network-accessible, unauthenticated HTTP endpoint.
DNS rebinding in MCP Ruby SDK's StreamableHTTPTransport (mcp gem, all versions prior to 0.23.0) exposes locally running MCP servers to browser-driven tool invocation without authentication. The transport accepted HTTP requests without validating Host or Origin headers, allowing a malicious webpage to exploit short-TTL DNS re-resolution to reach the victim's loopback-bound server and call any registered MCP tool. No public exploit code is identified at time of analysis, and no CISA KEV listing exists; however, the CVSS 4.0 score of 6.9 with VC:H and SC:H reflects a meaningful confidentiality risk for developers actively using local MCP tooling alongside a browser.
Uncontrolled memory allocation in the official Model Context Protocol Ruby SDK (mcp gem) before 0.23.0 lets an unauthenticated remote attacker crash MCP servers by sending a single oversized JSON-RPC POST. The StreamableHTTPTransport read the entire request body into memory and parsed it with no size or JSON-nesting cap, so one request can allocate gigabytes and OOM-kill the worker (CVSS 7.5, availability-only impact). No public exploit identified at time of analysis, but the fix commit and 4 MiB default limit are public, making the mechanism trivially reproducible.
Session hijacking in the MCP Ruby SDK (mcp gem) before 0.23.0 lets an attacker who obtains a valid session ID issue tools/call requests that execute inside the victim's session, because StreamableHTTPTransport validates only session existence and idle timeout without binding a session to its owner. Affected deployments are those exposing the streamable HTTP transport; the flaw enables cross-session action execution and in-flight request tampering (e.g. notifications/cancelled). No public exploit identified at time of analysis and the issue is not in CISA KEV; the vendor CVSS 4.0 score is 8.3 (integrity-focused).
Uncontrolled memory growth in the MCP Ruby SDK (mcp gem) prior to 0.23.0 allows any peer process communicating via stdio to OOM-kill the host Ruby process by sending a continuous byte stream without a newline, exhausting available system memory. Both the server-side MCP::Server::Transports::StdioTransport and client-side MCP::Client::Stdio components are affected, meaning Ruby applications acting as either MCP servers or MCP clients are vulnerable. No public exploit has been identified at time of analysis, and no CISA KEV listing exists, but the attack is mechanically trivial for any process with stdio access to the target.
Unbounded session growth in MCP Ruby SDK's StreamableHTTPTransport allows unauthenticated remote attackers to exhaust server process memory by repeatedly sending initialize requests. Affected versions prior to 0.23.0 defaulted to no session expiry and no concurrent session cap, meaning each initialize request created a persistent ServerSession object that was never reclaimed without an explicit client DELETE. No public exploit has been identified at time of analysis, and exploitation is not confirmed by CISA KEV, but the attack is trivially automatable given the network-accessible, unauthenticated HTTP endpoint.
DNS rebinding in MCP Ruby SDK's StreamableHTTPTransport (mcp gem, all versions prior to 0.23.0) exposes locally running MCP servers to browser-driven tool invocation without authentication. The transport accepted HTTP requests without validating Host or Origin headers, allowing a malicious webpage to exploit short-TTL DNS re-resolution to reach the victim's loopback-bound server and call any registered MCP tool. No public exploit code is identified at time of analysis, and no CISA KEV listing exists; however, the CVSS 4.0 score of 6.9 with VC:H and SC:H reflects a meaningful confidentiality risk for developers actively using local MCP tooling alongside a browser.