CVE-2026-67430

Deferred Deferred - Pending Action

Memory Leak in MCP Ruby SDK StreamableHTTPTransport

Publication date: 2026-07-29

Last updated on: 2026-07-30

Assigner: GitHub, Inc.

Description

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not expire sessions by default, so repeated initialize requests retain unbounded ServerSession objects and can exhaust process memory. This issue is fixed in version 0.23.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-30

Generated

2026-08-19

AI Q&A

2026-07-30

EPSS Evaluated

2026-08-18

NVD

CVE-2026-67430

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-401	The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

The MCP Ruby SDK before version 0.23.0 has a vulnerability where the MCP::Server::Transports::StreamableHTTPTransport does not expire sessions by default. This allows repeated initialize requests to create unbounded ServerSession objects, leading to potential memory exhaustion in the process.

Detection Guidance

Detect this vulnerability by checking the version of the mcp gem in use. If it is below 0.23.0, the system is vulnerable. Run 'gem list mcp' to check the installed version.

Impact Analysis

This vulnerability can cause your application to run out of memory due to accumulating ServerSession objects from repeated requests. This may lead to crashes, degraded performance, or denial of service if the memory is exhausted.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it primarily involves resource exhaustion through unbounded session retention. However, if the memory exhaustion leads to service disruption or data processing failures, it could indirectly impact compliance by violating availability requirements in these standards.

Mitigation Strategies

Upgrade the mcp gem to version 0.23.0 or later. Use the command 'gem install mcp -v 0.23.0' or update your Gemfile to specify the version.

Hi! I’m here to help you understand CVE-2026-67430. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70