Approved changes feed: RSS · Atom
cpe:2.3:a:modelcontextprotocol:ruby-sdk:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Modelcontextprotocol (082e8d84-965b-5156-ba15-e7a9bafb2a96) |
|---|---|
| Product | Ruby Sdk (dc9ce491-2bd3-5851-b102-6e5c5ae53d7f) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-67432 |
vulnerable | 2026-09-16 04:33:05.933929 |
MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport
HIGH (7.5)
MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem reads and parses an entire JSON-RPC POST body without a size limit, allowing an unauthenticated remote attacker to exhaust process memory. This issue is fixed in version 0.23.0.
Published: 2026-07-29T19:17:46.518Z
Updated: 2026-07-29T19:34:24.640Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-67430 |
vulnerable | 2026-09-16 04:33:05.766612 |
MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood
MEDIUM (5.3)
MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not expire sessions by default, so repeated initialize requests retain unbounded ServerSession objects and can exhaust process memory. This issue is fixed in version 0.23.0.
Published: 2026-07-29T19:10:39.552Z
Updated: 2026-07-30T15:19:09.224Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-67431 |
vulnerable | 2026-09-16 04:33:05.715211 |
MCP Ruby SDK: Ruby SSE Session Poisoning
MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not bind a session ID to a session owner, allowing an attacker with a stolen session ID to send tools/call requests that execute in the victim's session. This issue is fixed in version 0.23.0.
Published: 2026-07-29T19:15:32.340Z
Updated: 2026-07-30T14:35:45.395Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-63119 |
vulnerable | 2026-09-16 04:32:49.563599 |
MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)
MEDIUM (6.2)
MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StdioTransport and MCP::Client::Stdio in the mcp gem use IO#gets without a byte limit, allowing a peer that sends data without a newline to exhaust process memory. This issue is fixed in version 0.23.0.
Published: 2026-07-29T19:12:07.687Z
Updated: 2026-07-29T19:28:41.352Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-63118 |
vulnerable | 2026-09-16 04:32:49.518871 |
MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection
MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not validate the HTTP Host or Origin request headers, which allows a malicious browser page to use DNS rebinding to reach a locally running MCP server and invoke exposed tools. This issue is fixed in version 0.23.0.
Published: 2026-07-29T19:07:33.452Z
Updated: 2026-07-29T19:35:10.375Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-33946 |
vulnerable | 2026-06-08 07:59:11.621428 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.