CVE-2026-67430

MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood

State: Published
Severity: 5.3 Medium
Published: Jul 29, 2026
Updated: Jul 30, 2026
Reserved: Jul 29, 2026

Description

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not expire sessions by default, so repeated initialize requests retain unbounded ServerSession objects and can exhaust process memory. This issue is fixed in version 0.23.0.

Scores

CVSS	Score	Vector	Source
3.1	5.3 Medium	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	GitHub_M

Weaknesses

CWE-401 Missing Release of Memory after Effective Lifetime
CWE-770 Allocation of Resources Without Limits or Throttling

Affected Products

Product	Versions
ruby-sdkmodelcontextprotocol	< 0.23.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.