CVE-2026-67430

MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not expire sessions by default, so repeated initialize requests retain unbounded ServerSession objects and can exhaust process memory. This issue is fixed in version 0.23.0.

Affected

modelcontextprotocol · ruby-sdk

CVSS v3.1 GITHUB

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS

0.51% chance of exploitation in the next 30 days, 42nd percentile

Published

2026-07-29

Updated

2026-07-30

Proof-of-concept exploits (1)

• advisories/GHSA-52jp-gj8w-j6xh

References

• CVE Record
• NVD entry