Skip to main content
cve.nowby Sazabi
← RubyGems
RubyGemsPackage

mcp

6 known vulnerabilities (3 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
6 · 3 high, 3 medium
Registry
RubyGems

Advisories 6

  • MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport

    Affected: fixed in 0.23.0.

  • MCP Ruby SDK: Ruby SSE Session Poisoning

    Affected: fixed in 0.23.0.

  • CVE-2026-63119Medium 6.2

    MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS)

    Affected: fixed in 0.23.0.

  • CVE-2026-67430Medium 5.3

    MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood

    Affected: fixed in 0.23.0.

  • CVE-2026-63118Medium 6.9

    MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection

    Affected: fixed in 0.23.0.

  • MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay

    Affected: fixed in 0.9.2.