Vulnerability · Published Jul 29, 2026 · Assigned by GitHub_M

CVE-2026-67430MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood

Medium 5.3

In plain English

A medium-severity memory leak in ruby-sdk from modelcontextprotocol. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.4%top 69.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not expire sessions by default, so repeated initialize requests retain unbounded ServerSession objects and can exhaust process memory. This issue is fixed in version 0.23.0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
RubyGems	mcp	0.23.0	GHSA-52jp-gj8w-j6xh

Affected products (as reported)

Vendor	Product	Versions
modelcontextprotocol	ruby-sdk	< 0.23.0

Weakness: CWE-401, CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References

https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-52jp-gj8w-j6xh x_refsource_CONFIRM
https://github.com/modelcontextprotocol/ruby-sdk/commit/afb968c468c178c4d3294b423fcce250621692f4 x_refsource_MISC
https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0 x_refsource_MISC