CVE-2026-67430

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not expire sessions by default, so repeated initialize requests retain unbounded ServerSession objects and can exhaust process memory. This issue is fixed in version 0.23.0.

CVSS v3.1

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CVSS v3.1

5.3 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS

0.31% chance of exploitation in the next 30 days, 23th percentile

Published

2026-07-29

Updated

2026-07-30

Proof-of-concept exploits (1)

• advisories/GHSA-52jp-gj8w-j6xh

References

• CVE Record
• NVD entry

Related

• CVE-2026-6743
• CVE-2026-67431
• CVE-2026-67429
• CVE-2026-67432
• CVE-2026-67428
• CVE-2026-67438