What’s Vulnerable › Products

modelcontextprotocol ruby-sdk vulnerabilities

6 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 6 published in the last 12 months.

Check whether your modelcontextprotocol ruby-sdk version is affected

Latest modelcontextprotocol ruby-sdk vulnerabilities

• CVE-2026-67432 — MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport (CVSS 7.5)
• CVE-2026-67431 — MCP Ruby SDK: Ruby SSE Session Poisoning (CVSS 8.3)
• CVE-2026-67430 — MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood (CVSS 5.3)
• CVE-2026-63119 — MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS) (CVSS 6.2)
• CVE-2026-63118 — MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection (CVSS 6.9)
• CVE-2026-33946 — MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay (CVSS 5.9)