CVE-2026-67430

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-67430

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67430.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-67430

Aliases

GHSA-52jp-gj8w-j6xh

Published

2026-07-29T19:10:39.552Z

Modified

2026-07-30T04:01:39.336740297Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator

Summary

MCP Ruby SDK: Unbounded session retention in StreamableHTTPTransport allows memory exhaustion via initialize flood

Details

MCP Ruby SDK is the official Ruby SDK for Model Context Protocol servers and clients. Prior to 0.23.0, MCP::Server::Transports::StreamableHTTPTransport in the mcp gem does not expire sessions by default, so repeated initialize requests retain unbounded ServerSession objects and can exhaust process memory. This issue is fixed in version 0.23.0.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/67xxx/CVE-2026-67430.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-401",
        "CWE-770"
    ]
}

References

Affected packages

Git / github.com/modelcontextprotocol/ruby-sdk

Affected ranges

Type

GIT

Repo

https://github.com/modelcontextprotocol/ruby-sdk

Events

Introduced

Fixed

95feef2dcfba25d92a8963d14b7a3b279122f36f

Database specific

{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "0.23.0"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

v0.*

v0.1.0

v0.10.0

v0.11.0

v0.12.0

v0.13.0

v0.14.0

v0.15.0

v0.16.0

v0.17.0

v0.18.0

v0.19.0

v0.2.0

v0.20.0

v0.21.0

v0.22.0

v0.3.0

v0.4.0

v0.5.0

v0.6.0

v0.7.0

v0.7.1

v0.8.0

v0.9.0

v0.9.1

v0.9.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-67430.json"