RubyGems/mcp CVE-2026-63118: medium 6.9, EPSS 0.24%

MCP Ruby SDK: Streamable HTTP transport lacks DNS-rebinding (Host/Origin) protection

Action: Upgrade mcp to 0.23.0 or later.

bundle update mcp

Affected

Fixed versions

Sources

• osv: GHSA-rjr6-rcgv-9m7m
• nvd: CVE-2026-63118
• https://github.com/modelcontextprotocol/ruby-sdk/security/advisories/GHSA-rjr6-rcgv-9m7m
• https://github.com/modelcontextprotocol/ruby-sdk/commit/ba543083a7594e7892b29464b89091816446ff7a
• https://github.com/modelcontextprotocol/ruby-sdk
• https://github.com/modelcontextprotocol/ruby-sdk/releases/tag/v0.23.0

CVE-2026-63118 · published 2026-07-30T14:41:39Z · modified 2026-07-30T14:45:28.029334068Z · JSON