@modelcontextprotocol ruby-sdk

• CVE-2026-67432 High 7.5 MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport 0.8%
• CVE-2026-67431 High 8.3 MCP Ruby SDK: Ruby SSE Session Poisoning 0.4%
• CVE-2026-63119 Medium 6.2 MCP Ruby SDK: Unbounded line buffer in stdio transports leads to memory exhaustion (DoS) 0.2%
• CVE-2026-67430 Medium 5.3 MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood 0.4%
• CVE-2026-63118 Medium 6.9 MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection 0.2%
• CVE-2026-33946 High 8.2 MCP Ruby SDK: Insufficient Session Binding Allows SSE Stream Hijacking via Session ID Replay 0.5%