CVE-2026-67432

Received Received - Intake

Memory Exhaustion in MCP Ruby SDK via Unlimited JSON-RPC Body

Publication date: 2026-07-29

Last updated on: 2026-07-29

Assigner: GitHub, Inc.

Description

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem reads and parses an entire JSON-RPC POST body without a size limit, allowing an unauthenticated remote attacker to exhaust process memory. This issue is fixed in version 0.23.0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-29

Last Modified

2026-07-29

Generated

2026-07-30

AI Q&A

2026-07-30

EPSS Evaluated

N/A

NVD

CVE-2026-67432

Affected Vendors & Products

Vendor	Product	Version / Range
mcp	ruby_sdk	0.23.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-770	The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

Executive Summary

The vulnerability is in the MCP Ruby SDK before version 0.23.0. The MCP::Server::Transports::StreamableHTTPTransport component reads and parses an entire JSON-RPC POST body without enforcing a size limit. This allows unauthenticated remote attackers to send large requests that consume excessive server memory, leading to a denial of service.

Detection Guidance

Detecting this vulnerability requires checking if the mcp gem version is below 0.23.0. Run gem list mcp to check the installed version. If the version is older, the system is vulnerable.

Impact Analysis

If you use the MCP Ruby SDK prior to version 0.23.0, an attacker could exploit this flaw to crash your server by sending oversized JSON-RPC requests. This would disrupt service availability and potentially cause downtime for applications relying on the SDK.

Mitigation Strategies

Upgrade the mcp gem to version 0.23.0 or later using gem install mcp --version 0.23.0. Restart any affected services after upgrading to apply the fix.

Hi! I’m here to help you understand CVE-2026-67432. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70